| { |
| "item_id": "ker-bytes_reserve", |
| "kernel": "bytes_reserve", |
| "advisory": "RUSTSEC-2026-0007", |
| "crate": "bytes", |
| "pre_version": "1.11.0", |
| "post_version": "1.11.1", |
| "advisory_url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f", |
| "title": "Integer overflow in `BytesMut::reserve`", |
| "source_file": "src/bytes_mut.rs", |
| "function": "reserve_fits", |
| "signature": "pub fn reserve_fits(v_capacity: usize, new_cap: usize, offset: usize) -> bool", |
| "spec_doc": "Decides whether a Vec-backed buffer with capacity v_capacity can serve a reserve request of new_cap bytes when the live window starts at offset; must be true iff v_capacity >= new_cap + offset in exact arithmetic.", |
| "bug_class": "overflow", |
| "fidelity": "verbatim_logic", |
| "extraction_note": "src/bytes_mut.rs reserve_inner: new_cap + offset overflow", |
| "witness_args": "10usize, usize::MAX, 1usize", |
| "labels": { |
| "buggy": "bytes@1.11.0", |
| "reference": "bytes@1.11.1" |
| } |
| } |
