~ / search / GHSA-3vv3-frrq-6486

GHSA-3vv3-frrq-6486

Use of Uninitialized Resource in alg_ds

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-36432

Packages

EcosystemPackageAffectedFixed in
crates.io alg_ds <= 0.3.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. `Matrix::new()` internally calls `Matrix::fill_with()` which uses `*ptr = value` pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct.

References

External links from the advisory. They lead to third-party sites.