diff --git a/crates/fast-able/RUSTSEC-0000-0000.md b/crates/fast-able/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..33fca3dad --- /dev/null +++ b/crates/fast-able/RUSTSEC-0000-0000.md @@ -0,0 +1,40 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "fast-able" +date = "2025-04-25" +categories = ["memory-corruption"] + +[versions] +patched = [] +unaffected = [] +``` + +# Possible unsound public API + +At src/vec.rs: + +```rust +impl SyncVec +where + V: Clone, +{ + pub fn to_vec(&self) -> Vec { + let mut v = Vec::new(); + for i in self.iter() { + v.push(i.clone()); + } + v + } +} + +impl SyncVec { + ... + #[inline] + pub fn get_uncheck(&self, index: usize) -> &V { + unsafe { (&*self.dirty.get()).get_unchecked(index) } + } +``` + +The public accessible struct SyncVec has a public method get_unchecked. It accept a parameter index and used in the get_unchecked without sufficient checks as mentioned [here](https://doc.rust-lang.org/std/primitive.slice.html#method.get_unchecked). In Rust, safe function should not cause memory risks. +