MEDIUM

GHSA-f9g6-fp84-fv92

impl `FromMdbValue` for bool is unsound

Details

The implementation of `FromMdbValue` has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug are available [here](https://github.com/vhbit/lmdb-rs/issues/67).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/lmdb-rs

Introduced in: 0

No fixed version published yet for lmdb-rs. Pin to a known-safe version or switch to an alternative.

References

https://github.com/vhbit/lmdb-rs/issues/67[WEB]
https://github.com/vhbit/lmdb-rs[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2023-0047.html[WEB]