From 9441f916acff910a6183e816ed490ff025d5c13d Mon Sep 17 00:00:00 2001 From: Safe4U Date: Sun, 7 Jul 2024 21:34:43 +0800 Subject: [PATCH] Add advisory for arrow2 --- crates/arrow2/RUSTSEC-0000-0000.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 crates/arrow2/RUSTSEC-0000-0000.md diff --git a/crates/arrow2/RUSTSEC-0000-0000.md b/crates/arrow2/RUSTSEC-0000-0000.md new file mode 100644 index 0000000000..3086891046 --- /dev/null +++ b/crates/arrow2/RUSTSEC-0000-0000.md @@ -0,0 +1,21 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "arrow2" +date = "2024-07-07" +url = "https://github.com/jorgecarleitao/arrow2/blob/main/src/compute/sort/row/mod.rs#L272" +informational = "unsound" +categories = ["memory-exposure"] + +[affected] +functions = { "arrow2::compute::sort::row::Rows::row_unchecked" = [">= 0.14.2, <= 0.18.0"] } + +[versions] +patched = [] +``` + +# Unsoundly mark unsafe function as safe + +The function `Rows::row_unchecked` is wrongly marked as safe, which would confuse +the boundary between safe and unsafe Rust and allow illegal memory access in safe +Rust.