{"id":"RUSTSEC-2024-0435","summary":"Unsound usages of `Vec::from_raw_parts`","details":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","aliases":["GHSA-h7h7-6mx3-r89v"],"modified":"2025-10-28T06:29:25.103174Z","published":"2024-12-19T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/fyrox-core"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2024-0435.html"},{"type":"REPORT","url":"https://github.com/FyroxEngine/Fyrox/issues/630"},{"type":"WEB","url":"https://github.com/FyroxEngine/Fyrox/pull/662"}],"affected":[{"package":{"name":"fyrox-core","ecosystem":"crates.io","purl":"pkg:cargo/fyrox-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.36.0"}]}],"ecosystem_specific":{"affects":{"os":[],"arch":[],"functions":["fyrox_core::transmute_vec_as_bytes"]},"affected_functions":null},"database_specific":{"cvss":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0435.json","categories":[],"informational":"unsound"}}],"schema_version":"1.7.3"}