{"id":"GHSA-h7h7-6mx3-r89v","summary":"Fyrox has unsound usages of `Vec::from_raw_parts` ","details":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","aliases":["RUSTSEC-2024-0435"],"modified":"2026-09-10T03:50:22.753279979Z","published":"2025-02-14T17:31:16Z","database_specific":{"github_reviewed_at":"2025-02-14T17:31:16Z","nvd_published_at":null,"cwe_ids":[],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/FyroxEngine/Fyrox/issues/630"},{"type":"WEB","url":"https://github.com/FyroxEngine/Fyrox/pull/662"},{"type":"WEB","url":"https://github.com/FyroxEngine/Fyrox/commit/474e3b01a884366cdb7d704f7456ef692e992232"},{"type":"PACKAGE","url":"https://github.com/FyroxEngine/Fyrox"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0435.html"}],"affected":[{"package":{"name":"fyrox-core","ecosystem":"crates.io","purl":"pkg:cargo/fyrox-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.1"},{"fixed":"0.36"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-h7h7-6mx3-r89v/GHSA-h7h7-6mx3-r89v.json"}}],"schema_version":"1.9.0"}