GHSA-f9g6-fp84-fv92: impl `FromMdbValue` for bool is unsound

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-f9g6-fp84-fv92

impl `FromMdbValue` for bool is unsound

Moderate severity GitHub Reviewed Published Jul 19, 2023 to the GitHub Advisory Database • Updated Jul 19, 2023

Package

cargo lmdb-rs (Rust)

Affected versions

<= 0.7.6

Description

The implementation of FromMdbValue has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug are available here.

References

• vhbit/lmdb-rs#67
• https://rustsec.org/advisories/RUSTSEC-2023-0047.html

Published to the GitHub Advisory Database

Jul 19, 2023

Last updated

Jul 19, 2023