Reported

June 26, 2023

Issued

July 18, 2023 (last modified: July 29, 2023)

Package

lmdb-rs (crates.io)

Type

INFO Unsound

Keywords

#unsound

Aliases

• GHSA-f9g6-fp84-fv92

References

• https://github.com/vhbit/lmdb-rs/issues/67

Patched

no patched versions

Description

The implementation of FromMdbValue have several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug were included in url above.

Advisory available under CC0-1.0 license.