PT-2026-31670 · Crates.Io · Intaglio
Publicado
2026-03-30
·
Atualizado
2026-03-30
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Affected versions of this crate can leave all
SymbolTable variants in an
internally inconsistent state if a custom BuildHasher panics during
HashMap::insert and the caller recovers with catch unwind.The
intern implementations committed a vec.push(...) before the matching
map.insert(...) completed. If hashing panicked in that window, later lookups
and inserts could observe diverging vec and map lengths.In release builds, this can lead to symbol confusion where a newly interned
string resolves to previously interned attacker-controlled contents. In debug
builds, the same corruption is detected by follow-up assertions and results in
panics.
The flaw was corrected in version 1.13.3 by making the
vec mutation
transactional across unwind boundaries so partially inserted entries are rolled
back before the panic propagates. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Intaglio