GHSA-jh37-772x-4hpw
Double free in algorithmica
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | algorithmica | <= 0.1.8 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
References
External links from the advisory. They lead to third-party sites.