Reported

January 19, 2024

Issued

January 23, 2024 (last modified: February 10, 2024)

Package

rust-i18n-support (crates.io)

Type

INFO Unsound

Categories

• memory-exposure

Aliases

• GHSA-c8v3-jhv9-4ppc

References

• https://github.com/longbridgeapp/rust-i18n/issues/71
• https://github.com/longbridgeapp/rust-i18n/pull/72
• https://github.com/longbridgeapp/rust-i18n/releases/tag/v3.0.1

Patched

• >=3.0.1

Unaffected

• <3.0.0

Affected Functions

Version

rust_i18n_support::AtomicStr::as_str

• <3.0.1, >=3.0.0

Description

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.

If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.

Advisory available under CC0-1.0 license.