{"schema_version":"1.7.3","id":"RUSTSEC-2020-0052","published":"2020-06-26T12:00:00Z","modified":"2023-11-08T04:02:35.713139Z","aliases":["CVE-2020-15254","CVE-2020-35904","GHSA-m8h8-v6jh-c762","GHSA-v5m7-53cv-f3hx"],"summary":"Undefined Behavior in bounded channel","details":"The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.","affected":[{"package":{"name":"crossbeam-channel","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-channel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.3"},{"fixed":"0.4.4"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0052.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/crossbeam-channel"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2020-0052.html"},{"type":"WEB","url":"https://github.com/crossbeam-rs/crossbeam/pull/533"}],"database_specific":{"license":"CC0-1.0"}}