search

jonathanmorley / oktaws

Apache License 2.0
15 stars 10 forks source link

[Security] Bump smallvec from 0.6.5 to 0.6.13 #92

Closed dependabot-preview[bot] closed 4 years ago

dependabot-preview[bot] commented 4 years ago

Bumps smallvec from 0.6.5 to 0.6.13. This update includes security fixes.

Vulnerabilities fixed *Sourced from [The RustSec Advisory Database](https://github.com/RustSec/advisory-db/blob/master/crates/smallvec/RUSTSEC-0000-0000.toml).* > **Memory corruption in SmallVec::grow()** > Attempting to call `grow` on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures. > > An attacker that controls the value passed to `grow` may exploit this flaw to obtain memory contents or gain remote code execution. > > Credits to [@​ehuss](https://github.com/ehuss) for discovering, reporting and fixing the bug. > > Patched versions: >= 0.6.10 > Unaffected versions: < 0.6.3 *Sourced from [The RustSec Advisory Database](https://github.com/RustSec/advisory-db/blob/master/crates/smallvec/RUSTSEC-0000-0000.toml).* > **Double-free and use-after-free in SmallVec::grow()** > Attempting to call `grow` on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. > > An attacker that controls the value passed to `grow` may exploit this flaw to obtain memory contents or gain remote code execution. > > Credits to [@​ehuss](https://github.com/ehuss) for discovering, reporting and fixing the bug. > > Patched versions: >= 0.6.10 > Unaffected versions: < 0.6.5
Release notes *Sourced from [smallvec's releases](https://github.com/servo/rust-smallvec/releases).* > ## v0.6.13 > * Use the `maybe-unit` crate in place of soon-to-be-deprecated `std::mem::uninitialized` ([#180](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/180)). When built with Rust 1.36 or later, this fixes a source of undefined behavior. It also fixes deprecation warnings in Rust 1.39 and later, and test failures when run in MIRI. In Rust 1.35 and earlier it provides some safety improvements but does not completely eliminate undefined behavior. (However, we are not aware of any cases where the undefined behavior causes bugs in practice in those toolchains.) > > ## v0.6.12 > * Move code using `default fn` into its own module ([#161](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/161)). > > ## v0.6.11 > * The unstable `alloc` feature is no longer needed. This crate can now build with the `std` feature disabled on stable Rust 1.36 or later ([#159](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/159)). > > ## v0.6.10 > * Fix a bug in `extend` with certain iterators ([#150](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/150)). > * Fix soundness bugs in the `grow` method ([#151](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/151), [#152](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/152)). > * Fix typo in docs ([#144](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/144)). > > ## v0.6.9 > * Remove dependency on `unreachable` crate ([#140](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/140)) > > ## v0.6.8 > * Don't leak memory if an iterator panics during `extend` ([#137](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/137)) > * Update the unstable `union` feature for better forward compatibility ([#135](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/135)) > > ## v0.6.7 > * Add an optional feature to use the unstable `may_dangle` attribute ([#133](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/133)). > > ## v0.6.6 > * Fix possible over-allocation in `from_slice` ([#122](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/122)) > * Optional nightly-only `specialization` feature for `from_slice` optimization ([#123](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/123)) > * New `from_raw_parts` constructor ([#130](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/130)) > * Documentation and testing improvements ([#125](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/125), [#129](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/129))
Commits - [`7852204`](https://github.com/servo/rust-smallvec/commit/78522049b3ce129d02eea4e802747ba1090a5586) Merge pull request [#180](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/180) from mbrubeck/maybe_uninit - [`58d5416`](https://github.com/servo/rust-smallvec/commit/58d5416fab7cae3d1f87f89a0afd91ffa1ccb7ee) Add a test for [#139](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/139). - [`26ea2ca`](https://github.com/servo/rust-smallvec/commit/26ea2caa43eabe5e3fe43b2ef4f3c60c757745c9) Run miri in CI - [`e64afc8`](https://github.com/servo/rust-smallvec/commit/e64afc8c473d43e375ab42bd33db2d0d4ac4e41b) Use MaybeUninit for storage of inline items. - [`87f156b`](https://github.com/servo/rust-smallvec/commit/87f156b7adc96100571baf602d5bc61bd4431626) Version 0.6.12 - [`e60df76`](https://github.com/servo/rust-smallvec/commit/e60df76fe606c5390b7505b12dc7b69e96b1260e) Version 0.6.11 - [`3ee6d1e`](https://github.com/servo/rust-smallvec/commit/3ee6d1e3e5a8b5a6eafa5f396c397d5038a9c97e) Auto merge of [#161](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/161) - Centril:master, r=emilio - [`92122e2`](https://github.com/servo/rust-smallvec/commit/92122e2d642f3610925679f8f1e6c3d259a7db09) Move use of 'default fn' to its own module. - [`c83bb71`](https://github.com/servo/rust-smallvec/commit/c83bb71afe7bdfd824da9c24cccc78753abb059e) Auto merge of [#159](https://github-redirect.dependabot.com/servo/rust-smallvec/issues/159) - CryZe:no-std, r=emilio - [`0e73d06`](https://github.com/servo/rust-smallvec/commit/0e73d06843aca2515acc09bde28294a0f655b285) alloc is now stable - Additional commits viewable in [compare view](https://github.com/servo/rust-smallvec/compare/v0.6.5...v0.6.13)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)
dependabot-preview[bot] commented 4 years ago

Looks like smallvec is no longer updatable, so this is no longer needed.