[GH-ISSUE #546] RUSTSEC-2025-0047: Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check #58

New issue

Closed

opened 2026-03-03 13:45:21 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 13:45:21 +03:00

Owner

Originally created by @github-actions[bot] on GitHub (Aug 13, 2025).
Original GitHub issue: https://github.com/gopher64/gopher64/issues/546

Out-of-bounds access in get_disjoint_mut due to incorrect bounds check

Details
Package	`slab`
Version	`0.4.10`
URL	https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv
Date	2025-08-12
Patched versions	`>=0.4.11`
Unaffected versions	`<0.4.10`

Impact

The get_disjoint_mut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.

Patches

This has been fixed in slab v0.4.11.

Workarounds

Avoid using get_disjoint_mut with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.

References

https://github.com/tokio-rs/slab/pull/152

See advisory page for additional details.

Originally created by @github-actions[bot] on GitHub (Aug 13, 2025). Original GitHub issue: https://github.com/gopher64/gopher64/issues/546 > Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check | Details | | | ------------------- | ---------------------------------------------- | | Package | `slab` | | Version | `0.4.10` | | URL | [https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv](https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv) | | Date | 2025-08-12 | | Patched versions | `>=0.4.11` | | Unaffected versions | `<0.4.10` | ## Impact The `get_disjoint_mut` method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. ## Patches This has been fixed in slab v0.4.11. ## Workarounds Avoid using `get_disjoint_mut` with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later. ## References * [https://github.com/tokio-rs/slab/pull/152](https://github.com/tokio-rs/slab/pull/152) See [advisory page](https://rustsec.org/advisories/RUSTSEC-2025-0047.html) for additional details.