GitHub Advisoryadvisory · crates.io

GHSA-m2xr-2vj4-wh94 tanton_engine has unsound public API

MEDIUM Published 2025-05-06 Modified 2025-05-06 Official page ↗
Ecosystem
crates.io
Packages
tanton_engine
Severity
Moderate
Weaknesses
CWE-119
Reviewed
2025-05-06

Affected packages

• crates.io tanton_engine: <= 1.0.0 (no fix yet)

Description

The following functions in the `tanton_engine` crate are unsound due to lack of sufficient boundary checks in public API: • `Stack::offset()` • `ThreadStack::get()` • `RootMoveList::insert_score_depth()` • `RootMoveList::insert_score()` The tanton_engine crate is no longer maintained, so there are no plans to fix this issue.

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References