Reported

March 7, 2021

Issued

April 15, 2021 (last modified: June 13, 2023)

Package

algorithmica (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Aliases

• CVE-2021-31996
• GHSA-jh37-772x-4hpw

References

• https://github.com/AbrarNitk/algorithmica/issues/1

Patched

no patched versions

Description

In the affected versions of this crate, merge_sort::merge() wildly duplicates and drops ownership of T without guarding against double-free. Due to such implementation, simply invoking merge_sort::merge() on Vec<T: Drop> can cause double free bugs.

Advisory available under CC0-1.0 license.