GitHub Advisoryadvisory · crates.io

GHSA-48m6-wm5p-rr6h Insufficient covariance check makes self_cell unsound

HIGH Published 2023-11-14 Modified 2023-11-14 Official page ↗
Ecosystem
crates.io
Packages
self_cell
Severity
High
Reviewed
2023-11-14

Affected packages

• crates.io self_cell: < 0.10.3 → fixed in 0.10.3 • crates.io self_cell: >= 1.0.0, < 1.0.2 → fixed in 1.0.2

Description

All public versions prior to `1.02` used an insufficient check to ensure that users correctly marked the dependent type as either `covariant` or `not_covariant`. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is `type Dependent = RefCell>`. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as `covariant`.

References