GHSA-3qm2-rfqw-fmrw
move_elements can double-free objects on panic
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | scratchpad | < 1.3.1 | 1.3.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding.
The flaw was fixed in commit `891561bea` by removing the unsafe block and using a plain iterator.
References
External links from the advisory. They lead to third-party sites.