Reported

January 2, 2022

Issued

February 4, 2022 (last modified: June 13, 2023)

Package

windows (crates.io)

Type

INFO Unsound

Categories

• memory-corruption
• thread-safety

Aliases

• GHSA-x4mq-m75f-mx8m

References

• https://github.com/microsoft/windows-rs/issues/1409

Patched

• >=0.32.0

Unaffected

• <0.1.2

Affected OSes

• windows

Description

Affected versions of this crate did not require event handlers to have Send bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior.

The flaw was corrected in commit afe3252 by adding Send bounds.

Advisory available under CC0-1.0 license.