RustSec logo

HistoryEditJSON (OSV)

RUSTSEC-2023-0126

Aliasing violation in OrdSet insertion

Reported
Issued
Package
im (crates.io)
Type
INFO Unsound
Categories
References
Patched
no patched versions

Description

Inserting into an im::OrdSet (for example by collecting an iterator into one) can violate Rust's aliasing rules: Miri reports a stacked borrows violation in sized_chunks::Chunk::force_copy(), which is called during insertion, where a shared borrow is invalidated by a unique borrow before the read through it completes. This is undefined behavior, reachable from safe code.

No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.

Advisory available under CC0-1.0 license.