Unratedcrates.ioPublished
Double free in StackVec::retain when a predicate or element Drop panics
- Affected
- crates.io stack_collections >= 0.3.0, < 0.3.3
- Fixed in
- 0.3.3· Vendor fix available
- Issue
- `StackVec::retain` committed its new length to `self.len` only after its internal loop completed. If the retain predicate or a removed element's `Drop` implementation panicked before the loop finished, unwinding proceeded with `self.len` still equal to the original, pre-retain length, leaving either a duplicated or already-destroyed element inside `0..len`. `StackVec`'s own `Drop` then revisited that slot, causing a double-drop (and for heap-owning types, a double-free). Impact Affects `StackVec ::retain` for `T: Drop` types where the predicate or the removed element's destructor can panic, on builds with unwinding enabled (`panic = "unwind"`). `no_std`/`panic = "abort"` builds cannot trigger this, since unwinding never occurs. Patch Fixed in 0.3.3 using an unwind-safe backshift guard, matching the approach `alloc::vec::Vec::retain` uses.
Recommended action: Upgrade to 0.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.