GHSA-955p-rc5h-hg6h
Double free in arenavec
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Affected versions of this crate did not guard against potential panics that may happen from user-provided functions T::default() and T::drop().
Panic within T::default() leads to dropping uninitialized T, when it is invoked from common::Slice::<T, H>::new(). Panic within T::drop() leads to double drop of T, when it is invoked either from common::SliceVec::<T, H>::resize_with() or common::SliceVec::<T, H>::resize()
Either case causes memory corruption in the heap memory.
References
External links from the advisory. They lead to third-party sites.