~ / search / GHSA-f6g6-54hm-fhxv

GHSA-f6g6-54hm-fhxv

Data races in libsbc

Source: GitHub Advisory Database (reviewed) High CVE-2020-36440

Packages

EcosystemPackageAffectedFixed in
crates.io libsbc < 0.1.5 0.1.5

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread. This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex. The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.

References

External links from the advisory. They lead to third-party sites.