jonhoo / inferno

A Rust port of FlameGraph
Other
1.64k stars 117 forks source link

atty 0.2 has a potential unaligned read #278

Closed djc closed 1 year ago

djc commented 1 year ago

From cargo deny:

error[unsound]: Potential unaligned read
  ┌─ /Users/djc/src/flamegraph/Cargo.lock:4:1
  │
4 │ atty 0.2.14 registry+https://github.com/rust-lang/crates.io-index
  │ ----------------------------------------------------------------- unsound advisory detected
  │
  = ID: RUSTSEC-2021-0145
  = Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0145
  = On windows, `atty` dereferences a potentially unaligned pointer.

    In practice however, the pointer won't be unaligned unless a custom global allocator is used.

    In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.

    # atty is Unmaintained

    A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

    Last release of `atty` was almost 3 years ago.

    ## Possible Alternative(s)

    The below list has not been vetted in any way and may or may not contain alternatives;

     - [is-terminal](https://crates.io/crates/is-terminal)
     - std::io::IsTerminal *nightly-only experimental*
  = Announcement: https://github.com/softprops/atty/issues/50
  = Solution: No safe upgrade is available!
  = atty v0.2.14
    └── inferno v0.11.14
        └── flamegraph v0.6.2
djc commented 1 year ago

I think tracing-subscriber switched to nu-ansi-term. There is also an is_terminal crate, which I guess does everything you need here.

jonhoo commented 1 year ago

Moved to is-terminal in https://github.com/jonhoo/inferno/pull/280

djc commented 1 year ago

Cool, thanks!