PT-2025-36675 · Crates.Io · Toodee
Published
2025-05-22
·
Updated
2025-05-22
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
An off-by-one error in the
DrainCol::drop destructor could cause an unsafe memory copy
operation to exceed the bounds of the associated vector.The error was related to the size of the data being copied in one of the
ptr::copy
invocations inside the destructor.When removing the first column from a TooDee object, the DrainCol return object could cause
a heap buffer overflow vulnerability when it is dropped.
The issue was fixed in commit
e6e16d5 by reducing the copied size by one. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Toodee