Skip to content
Fencer Intel
medium —

GHSA-qq4c-hm99-979m json

IdMap from_iter may lead to uninitialized memory being freed on drop

published last yr. modified last yr. also RUSTSEC-2025-0050

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Due to a flaw in the constructor `id_map::IdMap::from_iter`, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of `IdMap`. Specifically, the field `ids` is initialized based on the capacity of the vector `values`, which is constructed from the provided iterator. However, the length of this vector may be smaller than its capacity.

In such cases, when the resulting `IdMap` is dropped, its destructor incorrectly assumes that `values` contains `ids.len() == values.capacity()` initialized elements and attempts to iterate over and drop them. This leads to dereferencing and attempting to free uninitialized memory, resulting in undefined behavior and potential segmentation faults.

The bug was fixed in commit `fab6922`, and all unsafe code was removed from the crate.

Note that the maintainer recommends using the following alternatives: - [slab](https://crates.io/crates/slab) - [slotmap](https://crates.io/crates/slotmap)

Patch / fix

  • crates.io id-map 0.2.2

Is GHSA-qq4c-hm99-979m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io id-map
>=0.1.6, <0.2.2
0.2.2

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.