2 results · Feed
-
Unscored —
Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)
Three removal and replacement paths destroy an initialized value before committing the metadata change that removes it. Destruction runs `T::drop()`, which is user code and may panic. If it does, the commit is skipped and the container still claims ownership …
-
Critical 9.8
Drop of uninitialized memory in stack_dst
An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic.