GitHub Advisoryadvisory · crates.io

GHSA-f9g6-fp84-fv92 impl `FromMdbValue` for bool is unsound

MEDIUM Published 2023-07-19 Modified 2023-07-19 Official page ↗
Ecosystem
crates.io
Packages
lmdb-rs
Severity
Moderate
Reviewed
2023-07-19

Affected packages

• crates.io lmdb-rs: <= 0.7.6 (no fix yet)

Description

The implementation of `FromMdbValue` has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug are available here.

References