Most recent entries from all

cnvd-2021-17265

EUVD-2026-25769

fkie_cve-2021-28029

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.

GHSA-xm9m-2vj8-fmfr — Uninitialized memory access in toodee

Affected: crates.io: toodee

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.

gsd-2021-28029

RUSTSEC-2021-0028 — Multiple memory safety issues in insert_row

Affected: crates.io: toodee

When inserting rows from an iterator at a particular index, `toodee` would shift items over, duplicating their ownership. The space reserved for the new elements was based on the `len()` returned by the `ExactSizeIterator`.

This could result in elements in the array being freed twice if the iterator panics. Uninitialized or previously freed elements could also be exposed if the `len()` didn't match the number of elements.

These issues were fixed in commit `ced70c17` by temporarily setting the length of the array smaller while processing it and adding assertions on the number of elements returned by the iterator.