Parser creates invalid uninitialized value
High severity
GitHub Reviewed
Published
Jun 16, 2022
to the GitHub Advisory Database
•
Updated Jan 12, 2023
Description
Published to the GitHub Advisory Database
Jun 16, 2022
Reviewed
Jun 16, 2022
Last updated
Jan 12, 2023
Affected versions of this crate called
mem::uninitialized()
in the HTTP1 parser to create values of typehttparse::Header
(from thehttparse
crate).This is unsound, since
Header
contains references and thus must be non-null.The flaw was corrected by avoiding the use of
mem::uninitialized()
, usingMaybeUninit
instead.References