RUSTSEC-2023-0046
(unsound)
on 2023-06-15: Misaligned pointer dereference in
ChunkId::new
This crate has no reviews yet. To add a review, set up your cargo-crev.
Crates in the crates.io registry are tarball snapshots uploaded by crates' publishers. The registry is not using crates' git repositories. There is absolutely no guarantee that the repository URL declared by the crate belongs to the crate, or that the code in the repository is the code inside the published tarball.
To review the actual code of the crate, it's best to use cargo crev open cyfs-base. Alternatively, you can download the tarball of cyfs-base v0.6.12 or view the source online.
The function
ChunkId::newcreates a misaligned pointer by casting mutable pointer ofu8slice which has alignment 1 to the mutable pointer ofu32which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function.GHSA-g753-ghr7-q33w