RUSTSEC-2021-0046

Dashboard / Vulnerabilities / RUSTSEC-2021-0046

RUSTSEC-2021-0046

Summary: misc::vec_with_size() can drop uninitialized memory if clone panics

Details: `misc::vec_with_size` creates a vector of the provided `size` and immediately calls `vec.set_len(size)` on it, initially filling it with uninitialized memory. It then inserts elements using `vec[i] = value.clone()`. If the `value.clone()` call panics, uninitialized items in the vector will be dropped leading to undefined behavior. ## Withdrawal This advisory has been withdrawn because the above unsoundness cannot be triggered in safe code by dependents of the crate, as the `Clone` generic of private function `misc::vec_with_size` only instantiates to primitive types in public functions, which is impossible to panic.

References: https://crates.io/crates/telemetry, https://rustsec.org/advisories/RUSTSEC-2021-0046.html, https://github.com/Yoric/telemetry.rs/issues/45