VDB
Sign up
MEDIUM

GHSA-gfgm-chr3-x6px

prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior

Details

In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here: 1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB). 2. Even if (1) is sound, `&Vec<T>` and `&[T]` still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/prettytable-rs
Introduced in: 0Fixed in: 0.10.0

Upgrade prettytable-rs to 0.10.0 or newer (ecosystem crates.io).

References