1 line
1.6 KiB
JSON
1 line
1.6 KiB
JSON
{"schema_version":"1.7.3","id":"RUSTSEC-2026-0001","published":"2026-01-05T12:00:00Z","modified":"2026-01-06T15:50:23.269686Z","summary":"Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM","details":"The `SharedPointer::alloc` implementation for `sync::Arc<T>` and `rc::Rc<T>` in `rkyv/src/impls/alloc/rc/atomic.rs` (and `rc.rs`) does not check if the allocator returns a null pointer on OOM (Out of Memory).\n\nThis null pointer can flow through to `SharedPointer::from_value`, which calls `Box::from_raw(ptr)` with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as `rkyv::from_bytes` or `rkyv::deserialize_using`) if an OOM condition occurs during the allocation of the shared pointer.\n\nThe issue is reachable through safe code and violates Rust's safety guarantees.","affected":[{"package":{"name":"rkyv","ecosystem":"crates.io","purl":"pkg:cargo/rkyv"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.46"},{"introduced":"0.8.0"},{"fixed":"0.8.13"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0001.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rkyv"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0001.html"},{"type":"REPORT","url":"https://github.com/rkyv/rkyv/issues/644"}],"database_specific":{"license":"CC0-1.0"}} |