arrayvec is vulnerable to Double Free
35
CVE Score
Low
Double Free
ArrayVec::extend_from_iter, used by extend(), collect(), and FromIterator, skips writing each element for zero-sized types but still increments the vector length. For a zero-sized type that implements Drop, the moved element is dropped once when the loop iteration ends and again later when the ArrayVec is dropped or cleared. This double drop is undefined behavior that any safe caller can trigger by extending an ArrayVec with such elements. The fix calls mem::forget on the element in the zero-sized case so it is dropped exactly once.
Upgrade the arrayvec library to the patch version.
You are affected if you are using a version that falls within the vulnerable range and you store a zero-sized type that implements Drop in an ArrayVec populated via extend(), collect(), or FromIterator.
0.7.5 - 0.7.6
Fixed in 0.7.7arrayvec is vulnerable to Double Free in versions 0.7.5 - 0.7.6.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.