RUSTSEC-2020-0130

Bunch unconditionally implements Send/Sync

Issued
Package
bunch (crates.io)
Type
Vulnerability
Categories
  • memory-corruption
  • thread-safety
Details
https://github.com/krl/bunch/issues/1
Patched
no patched versions

Description

Affected versions of this crate unconditionally implements Send/Sync for Bunch<T>. This allows users to insert T: !Sync to Bunch<T>. It is possible to create a data race to a T: !Sync by invoking the Bunch::get() API (which returns &T) from multiple threads. It is also possible to send T: !Send to other threads by inserting T inside Bunch<T> and sending Bunch<T> to another thread, allowing to create a data race by inserting types like T = Rc<_>.

Such data races can lead to memory corruption.

More