spirv-cross:parser_fuzzer: Crash in spirv_cross::SPIRBlock* spirv_cross::ObjectPool<spirv_cross::SPIRBlock>::allocat

Project: https://github.com/KhronosGroup/SPIRV-Cross.git Detailed Report: https://oss-fuzz.com/testcase?key=6259423779815424 Project: spirv-cross Fuzzing Engine: libFuzzer Fuzz Target: parserfuzzer Job Type: libfuzzerasanspirv-cross Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

crayon: ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

RUSTSEC-2024-0018 ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

Misbehaving `HandleLike` implementation can lead to memory safety violation

Unsafe code in ObjectPool has time-of-check to time-of-use TOCTOU bug that can eventually lead to a memory safety violation. ObjectPool and HandlePool implicitly assumes that HandleLike trait methods are pure, i.e., they always return the same value. However, this assumption is unsound since...

RUSTSEC-2020-0037 Misbehaving `HandleLike` implementation can lead to memory safety violation

Unsafe code in ObjectPool has time-of-check to time-of-use TOCTOU bug that can eventually lead to a memory safety violation. ObjectPool and HandlePool implicitly assumes that HandleLike trait methods are pure, i.e., they always return the same value. However, this assumption is unsound since...

PT-2020-17521

Name of the Vulnerable Software and Affected Versions crayon crate through 2020-08-31 for Rust Description The issue is related to a time-of-check to time-of-use TOCTOU bug in the ObjectPool and HandlePool, which can lead to a memory safety violation via HandleLike. This is because the HandleLike...