New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A bug in crossbeam v0.4.0 #75

Merged
merged 4 commits into from Dec 9, 2018

Conversation

Projects
None yet
3 participants
@stjepang
Copy link
Contributor

stjepang commented Dec 9, 2018

No description provided.

@stjepang stjepang referenced this pull request Dec 9, 2018

Merged

Use ManuallyDrop in queues #184

@Shnatsel

This comment has been minimized.

Copy link

Shnatsel commented Dec 9, 2018

According to the version specification here 0.3.2 is vulnerable, and that's the most popular version right now according to crates.io download statistics: https://crates.io/crates/crossbeam

Is 0.3.2 really affected?

@stjepang

This comment has been minimized.

Copy link
Contributor

stjepang commented Dec 9, 2018

@Shnatsel I believe you're right. The bug only happened because we allowed the epoch GC to run destructors. Thanks for pointing this out!

@@ -0,0 +1,56 @@
[advisory]
# Identifier for the advisory (mandatory). Will be assigned a "RUSTSEC-YYYY-NNNN"

This comment has been minimized.

@tarcieri

tarcieri Dec 9, 2018

Member

Can you please remove the comments? Thanks!

This comment has been minimized.

@stjepang

stjepang Dec 9, 2018

Contributor

Done.

@tarcieri

This comment has been minimized.

Copy link
Member

tarcieri commented Dec 9, 2018

Looks good, thanks!

@tarcieri tarcieri merged commit c0fdc45 into RustSec:master Dec 9, 2018

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details

tarcieri pushed a commit that referenced this pull request Dec 9, 2018

tarcieri added a commit that referenced this pull request Dec 9, 2018

@tarcieri

This comment has been minimized.

Copy link
Member

tarcieri commented Dec 9, 2018

Assigned RUSTSEC-2018-0009 in #76

@stjepang stjepang deleted the stjepang:crossbeam-0.4.0 branch Dec 9, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment