GitHub Advisoryadvisory · crates.io

GHSA-x8jh-xj3x-gx3c `fast-float` has multiple soundness issues

LOW Published 2024-11-12 Modified 2024-11-12 Official page ↗
Ecosystem
crates.io
Packages
fast-float
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Reviewed
2024-11-12

Affected packages

• crates.io fast-float: <= 0.2.0 (no fix yet)

Description

`fast-float` contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been merged into libcore. When requiring direct parsing from bytes and/or partial parsers, the `fast-float2` fork of `fast-float` containing these security patches and reduces overall usage of unsafe.

References