Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element.

This issue can result in an element being double-freed if the clone call panics.

Commit 20cb73d fixed this issue by adding a set_len(0) call before operating on the vector to avoid dropping the elements during a panic.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-26954
• https://rustsec.org/advisories/RUSTSEC-2021-0018.html
• qwertz19281/rust_utils#3
• qwertz19281/rust_utils@20cb73d