2 results · Feed
-
Medium —
OneRingBuf has a Use After Free Vulnerability
Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. For heap-backed ring buffers, this method returned a `DroppableRef` handle. `DroppableRef` stored an owning raw pointer created from `Box::in…
-
Unscored —
Double-free in `vmem` storage reachable from safe Rust
When the `vmem` feature is enabled, `VmemStorage<T>::new(Box<[UnsafeSyncCell<T>]>)` (and every public constructor that funnels through it — `ConcurrentHeapRB::default(cap)`, `ConcurrentHeapRB::from(Vec<T>)`, `From<Box<[T]>>`, etc.) bit-copies the input buffer…