GHSA-qq4c-hm99-979m: IdMap from_iter may lead to uninitialized memory being freed on drop
N/A
Basic Information
RustTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| id-map | rust | >= 0.1.6, < 0.2.2 | 0.2.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in the id_map::IdMap::from_iter constructor, which can create a malformed IdMap instance. Specifically, it initializes the ids field based on the capacity of the values vector, which can be larger than the number of elements actually initialized from the input iterator. When an IdMap created this way is dropped, its destructor (id_map::IdMap::drop) calls id_map::IdMap::drop_values. This function then iterates over the oversized ids set and attempts to drop elements from the values vector, leading to reads of uninitialized memory and subsequent attempts to free it. This results in undefined behavior and can cause a segmentation fault. The fix involves changing from_iter to correctly size the ids set based on the number of elements and removing the manual, unsafe drop implementation in favor of safer, compiler-generated code.