GitHub Advisoryadvisory · crates.io
GHSA-f67m-9j94-qv9j Parser creates invalid uninitialized value
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- hyper
- Severity
- High
- Reviewed
- 2022-06-16
Affected packages
• crates.io hyper: < 0.14.12 → fixed in 0.14.12
Description
Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate).
This is unsound, since `Header` contains references and thus must be non-null.
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.