GHSA-mc9m-6fm9-pghc: Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box>.
References
Code Behaviors & Features
Detect and mitigate GHSA-mc9m-6fm9-pghc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →