HIGH7.5

GHSA-cx4j-fxr7-jxg8

Double free in glsl-layout

Details

Affected versions of this crate did not guard against panic within the user-provided function f (2nd parameter of fn map_array), and thus panic within f causes double drop of a single object.

The flaw was corrected in the 0.4.0 release by wrapping the object vulnerable to a double drop within ManuallyDrop<T>.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/glsl-layout

Introduced in: 0Fixed in: 0.4.0

Upgrade glsl-layout to 0.4.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-25902[ADVISORY]
https://github.com/rustgd/glsl-layout/pull/10[WEB]
https://github.com/rustgd/glsl-layout[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0005.html[WEB]