Unratedcrates.ioPublished
Multiple soundness issues in lexical
GHSA-c2hm-mjxv-89r4
- Affected
- crates.io lexical <= 6.1.1
- Fixed in
- 7.0.0· Vendor fix available
- Issue
- lexical contains multiple soundness issues: 1. Bytes::read() allows creating instances of types with invalid bit patterns 1. BytesIter::read() advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat() calls MaybeUninit::assumeinit() on uninitialized data, which is is not allowed by the Rust abstract machine 1. radix() calls MaybeUninit::assumeinit() on uninitialized data, which is is not allowed by the Rust abstract machine The crate also has some correctness issues. Alternatives For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of lexical has been merged into libcore. For quickly parsing integers, consider atoi and btoi crates (100% safe code). atoiradix10 provides even faster parsing, but only with -C target-cpu=native, and at the cost of some unsafe. For formatting integers in a #[nostd] context consider the numtoa crate. For…
Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.