High, CVSS 7.5crates.ioPublished
eyre: Parts of Report are dropped as the wrong type during downcast
GHSA-4v52-7q2x-v4xj
- Affected
- crates.io eyre >= 0.6.9, < 0.6.12
- Fixed in
- 0.6.12· Vendor fix available
- Issue
- In affected versions, after a Report is constructed using wraperr or wraperrwith to attach a message of type D onto an error of type E, then using downcast to recover ownership of either the value of type D or the value of type E, one of two things can go wrong: - If downcasting to E, there remains a value of type D to be dropped. It is incorrectly "dropped" by running E's drop behavior, rather than D's. For example if D is &str and E is std::io::Error, there would be a call of std::io::Error::drop in which the reference received by the Drop impl does not refer to a valid value of type std::io::Error, but instead to &str. - If downcasting to D, there remains a value of type E to be dropped. When D and E do not happen to be the same size, E's drop behavior is incorrectly executed in the wrong location. The reference received by the Drop impl may point left or right of the real E value that is meant to be getting dropped. In both cases, when the Report contains an error E that has…
Recommended action: Upgrade to 0.6.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.