1 result · Feed
-
Unscored —
Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`
Two independent soundness problems, both reachable from safe Rust. `Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by hand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is user code and may panic. If it…