GitHub Advisoryadvisory · crates.io

GHSA-74r5-g7vc-j2v2 zerovec-derive incorrectly uses `#[repr(packed)]`

MEDIUM Published 2024-07-08 Modified 2024-07-09 Official page ↗
Ecosystem
crates.io
Packages
zerovec-derive
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-120
Reviewed
2024-07-08

Affected packages

• crates.io zerovec-derive: >= 0.10.0, < 0.10.3 → fixed in 0.10.3 • crates.io zerovec-derive: < 0.9.7 → fixed in 0.9.7

Description

The affected versions make unsafe memory accesses under the assumption that `#[repr(packed)]` has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 (1.80.0-beta) starts reordering fields of `#[repr(packed)]` structs, leading to illegal memory accesses. The patched versions `0.9.7` and `0.10.3` use `#[repr(C, packed)]`, which guarantees field order.

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References