0.4.0 (current) Thoroughness: Medium Understanding: High
by yvt on 2021-09-12
This review is from Crev, a distributed system for code reviews. To add your review, set up cargo-crev.
These reviews are from cargo-vet. To add your review, set up cargo-vet and submit your URL to its registry.
0.4.0 — diff review from 0.3.0 only (current)
From bytecodealliance/wasmtime. By Alex Crichton.
This bump only changed from a function to an associated const and trivially
contains no significant changes.
0.4.0 (current)
From kornelski/crev-proofs copy of git.savannah.gnu.org.
Packaged for Guix (crates-io)
cargo-vet does not verify reviewers' identity. You have to fully trust the source the audits are from.
- safe-to-run
-
This crate can be compiled, run, and tested on a local workstation or in controlled automation without surprising consequences. More…
- unknown
-
May have been packaged automatically without a review
Lib.rs has been able to verify that all files in the crate's tarball are in the crate's repository. Please note that this check is still in beta, and absence of this confirmation does not mean that the files don't match.
Crates in the crates.io registry are tarball snapshots uploaded by crates' publishers. The registry is not using crates' git repositories, so there is a possibility that published crates have a misleading repository URL, or contain different code from the code in the repository.
To review the actual code of the crate, it's best to use cargo crev open memory_units. Alternatively, you can download the tarball of memory_units v0.4.0 or view the source online.
This crate is sound - It includes no
unsafeblocks and performs no unexpected access to external environments. It has no build scripts.The
round_up_tomethod provided by this crate does not perform overflow checks nor describe its overflow behaviors. If the downstream crates don't handle this condition correctly, it might lead to a vulnerability similar to BadAlloc.This crate also assumes the compilation target's page size is 4096 bytes, which is not universal as exemplified by Apple Arm platforms.