3 results · Feed
-
Unscored —
Use-after-free from a comparator that answers inconsistently
`OrderedSkipList`, `SkipSet` and `SkipMap` can free a node that is still linked when a `Comparator` or `Ord` implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe `im…
-
Unscored —
Aliasing violations in splice, mutable iteration and cursors
Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard …
-
Unscored —
Use-after-free in `clear` and `retain` when an element's `Drop` panics
`SkipList::clear` drops the node chain and only then resets `tail` and `len`. The drop runs each element's `Drop`, and `T` carries no bounds excluding a panicking one. If it unwinds, `tail` still points at the freed node while `len` stays non-zero. `back()`, …