6 results · Feed
-
Medium —
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
`InlineVec::clear()` and `SerVec::clear()` in `rkyv` were not panic-safe. Both functions iterate over their elements and call `drop_in_place` on each, updating `self.len` only *after* the loop. If an element's `Drop` implementation panics during the loop, `se…
-
Unscored —
Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple `Rc`, `Arc`, or weak pointers that shared a data address but used dif…
-
Unscored —
Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
The archive validator could accept certain malformed relative pointers and invalid `ArchivedHashTable` states. In particular, the hash table verifier did not ensure that the number of occupied buckets matched the table's declared length. A crafted archive cou…
-
Unscored —
Crafted archives can cause a use-after-free during deserialization
Insufficient archive range validation could allow a crafted archive to reach `ArchivedString::deserialize` with an invalid pointer. A reported reproducer used `rkyv::from_bytes` to deserialize a struct containing strings, a vector, a box, and an optional hash…
-
Unscored —
Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
The `SharedPointer::alloc` implementation for `sync::Arc<T>` and `rc::Rc<T>` in `rkyv/src/impls/alloc/rc/atomic.rs` (and `rc.rs`) does not check if the allocator returns a null pointer on OOM (Out of Memory). This null pointer can flow through to `SharedPoint…
-
High 7.5
Use of uninitialized buffer in rkyv
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.