GHSA-r93v-9p5q-vhpf
futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | futures-task | >= 0.2.1, < 0.3.6 | 0.3.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.
The flaw was corrected by adding 'static lifetime bound to the data waker takes.
References
External links from the advisory. They lead to third-party sites.