GitHub Advisoryadvisory · crates.io

GHSA-f67m-9j94-qv9j Parser creates invalid uninitialized value

HIGH Published 2022-06-16 Modified 2022-06-16 Official page ↗
Ecosystem
crates.io
Packages
hyper
Severity
High
Reviewed
2022-06-16

Affected packages

• crates.io hyper: < 0.14.12 → fixed in 0.14.12

Description

Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate). This is unsound, since `Header` contains references and thus must be non-null. The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.

References