Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wcXB3LTg5dzUtODJ2Nc4ABBP6

`simd-json-derive` vulnerable to `MaybeUninit` misuse

An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)

The version 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.

Permalink: https://github.com/advisories/GHSA-pqpw-89w5-82v5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcXB3LTg5dzUtODJ2Nc4ABBP6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 8 days ago
Updated: 8 days ago

Identifiers: GHSA-pqpw-89w5-82v5
References:

• https://github.com/simd-lite/simd-json-derive/issues/67
• https://rustsec.org/advisories/RUSTSEC-2023-0087.html
• https://github.com/advisories/GHSA-pqpw-89w5-82v5

Repository: https://github.com/simd-lite/simd-json-derive
Blast Radius: 0.0

Affected Packages