GitHub Advisoryadvisory · crates.io

GHSA-gfgm-chr3-x6px prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior

MEDIUM Published 2022-12-30 Modified 2022-12-30 Official page ↗
Ecosystem
crates.io
Packages
prettytable-rs
Severity
Moderate
Reviewed
2022-12-30

Affected packages

• crates.io prettytable-rs: < 0.10.0 → fixed in 0.10.0

Description

In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here: 1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB). 2. Even if (1) is sound, `&Vec` and `&[T]` still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).

References