- Reported
-
- Issued
-
- Package
-
rkyv
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#oom
#undefined-behavior
- References
-
- Patched
-
>=0.7.46, <0.8.0>=0.8.13
Description
The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).
This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.
The issue is reachable through safe code and violates Rust's safety guarantees.
Advisory available under CC0-1.0
license.