GitHub Advisoryadvisory · crates.io

GHSA-9g55-pg62-m8hh Channel creates zero value of any type

HIGH Published 2022-06-16 Modified 2022-06-16 Official page ↗
Ecosystem
crates.io
Packages
crossbeam-channel
Severity
High
Reviewed
2022-06-16

Affected packages

• crates.io crossbeam-channel: < 0.4.3 → fixed in 0.4.3

Description

Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.

References