-
Notifications
You must be signed in to change notification settings - Fork 22
Open
Description
This crate has lots of unsafe code copied from the standard library several years ago. The stdlib is updated from time to time to fix problems in its unsafe code, but since this crate does not inherit those fixes, code in allocator-api2 remains buggy.
Just to give one example, when doing a security review of this crate, the first file I looked at was splice.rs, which is missing this change, meaning that this crate is using pointer::add in violation of its safety requirements. Every other file in the vec module I looked at is also missing things that have changed in the stdlib implementation.
Techcable
Metadata
Metadata
Assignees
Labels
No labels