Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

direct_ring_buffer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.0crates.ioPublished

    Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer

    GHSA-fp5x-7m4q-449f

    Affected
    • crates.io direct_ring_buffer < 0.2.2
    Fixed in
    0.2.2· Vendor fix available
    Issue
    The safe function createringbuffer allocates a buffer using Vec::withcapacity followed by setlen, creating a Box<[T] containing uninitialized memory. This leads to undefined behavior when functions like writeslices create typed slices (e.g., &mut [bool]) over the uninitialized memory, violating Rust's validity invariants. The issue has been confirmed using Miri. Fixed in version 0.2.2 by using resizewith to properly initialize the buffer with T::default(), adding a T: Default bound to ensure sound initialization.

    Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →