RUSTSEC-2021-0050

Dashboard / Vulnerabilities / RUSTSEC-2021-0050

RUSTSEC-2021-0050

Summary: swap_index can write out of bounds and return uninitialized memory

Details: `swap_index` takes an iterator and swaps the items with their corresponding indexes. It reserves capacity and sets the length of the vector based on the `.len()` method of the iterator. If the `len()` returned by the iterator is larger than the actual number of elements yielded, then `swap_index` creates a vector containing uninitialized members. If the `len()` returned by the iterator is smaller than the actual number of members yielded, then `swap_index` can write out of bounds past its allocated vector. As noted by the Rust documentation, [`len()`](https://doc.rust-lang.org/std/iter/trait.ExactSizeIterator.html#method.len) and `size_hint()` are primarily meant for optimization and incorrect values from their implementations should not lead to memory safety violations. # Patch A new version crate was pushed that marks this function as unsafe. reorder = "1.1.0" Previous versions have also been yanked from crates.io.

References: https://crates.io/crates/reorder, https://rustsec.org/advisories/RUSTSEC-2021-0050.html, https://github.com/tiby312/reorder/issues/1