GitHub Advisoryadvisory · crates.io
GHSA-gfgm-chr3-x6px prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- prettytable-rs
- Severity
- Moderate
- Reviewed
- 2022-12-30
Affected packages
• crates.io prettytable-rs: < 0.10.0 → fixed in 0.10.0
Description
In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here:
1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB).
2. Even if (1) is sound, `&Vec` and `&[T]` still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).