Description
The `bytes_helper` module contains multiple public functions
(`into_arr4()`, `into_arr2()`, `u8_from_le_bytes()`) that use
`slice.get_unchecked(pos..pos + N)` without verifying that
`pos + N <= slice.len()`. These are public safe API functions, allowing any
caller to trigger undefined behavior by passing invalid positions.
For example, calling `into_arr4(&data, 10)` where `data` is a 3-byte slice
causes an out-of-bounds access since position 10 exceeds the slice length.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | rustdx | >= 0.0.0-0, < 0.4.4 | 0.4.4 | RUSTSEC-2026-0123 |