Reported

August 14, 2021

Issued

August 21, 2021 (last modified: June 13, 2023)

Package

vec-const (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#memory-safety

Aliases

• CVE-2021-45680
• GHSA-jmwx-r3gq-qq3p
• GHSA-x76r-966h-5qv9

References

• https://github.com/Eolu/vec-const/issues/1#issuecomment-898908241

Patched

• >=2.0.0

Description

Affected versions of this crate claimed to construct a const Vec with nonzero length and capacity, but that cannot be done because such a Vec requires a pointer from an allocator.

The implementation was later changed to just construct a std::borrow::Cow.

Advisory available under CC0-1.0 license.