CVE-2020-25795: Missing release of memory in sized-chunks

August 25, 2021 (updated June 13, 2023)

Chunk:

Array size is not checked when constructed with unit() and pair().
Array size is not checked when constructed with From<InlineArray<A, T».
Clone and insert_from are not panic-safe; A panicking iterator causes memory safety issues with them.

InlineArray:

Generates unaligned references for types with a large alignment requirement.

References

github.com/advisories/GHSA-x54v-qxxr-93qc
github.com/bodil/sized-chunks
github.com/bodil/sized-chunks/issues/11
nvd.nist.gov/vuln/detail/CVE-2020-25795
rustsec.org/advisories/RUSTSEC-2020-0041.html

Code Behaviors & Features

Detect and mitigate CVE-2020-25795 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →