Skip to content
Fencer Intel
low —

GHSA-h5j3-crg5-8jqm json

orx-pinned-vec has undefined behavior in index_of_ptr with empty slices

published last yr. modified last yr. also RUSTSEC-2025-0106

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The safe function `index_of_ptr` causes undefined behavior when called with an empty slice.

The issue occurs in the line `ptr.add(slice.len() - 1)` which underflows when `slice.len()` is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.

Patch / fix

  • crates.io orx-pinned-vec 3.21.0

Is GHSA-h5j3-crg5-8jqm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io orx-pinned-vec
<3.21.0
>=0.0.0-0, <3.21.0
3.21.0

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-191 Integer Underflow (Wrap or Wraparound)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.