| { | |
| "item_id": "ker-toodee_drain", | |
| "kernel": "toodee_drain", | |
| "advisory": "RUSTSEC-2025-0062", | |
| "crate": "toodee", | |
| "pre_version": "0.5.0", | |
| "post_version": "0.6.0", | |
| "advisory_url": "https://github.com/antonmarsden/toodee/issues/26", | |
| "title": "Heap Buffer Overflow in the DrainCol Destructor", | |
| "source_file": "src/toodee.rs", | |
| "function": "drain_col_copy_len", | |
| "signature": "pub fn drain_col_copy_len(orig_cols: usize, col: usize) -> usize", | |
| "spec_doc": "When removing column col from a row of orig_cols cells, the number of cells to shift left: those strictly after col (orig_cols - col - 1).", | |
| "bug_class": "overflow", | |
| "fidelity": "verbatim_logic", | |
| "extraction_note": "src/toodee.rs DrainCol::drop: ptr::copy length off by one (heap overflow)", | |
| "witness_args": "5usize, 2usize", | |
| "labels": { | |
| "buggy": "toodee@0.5.0", | |
| "reference": "toodee@0.6.0" | |
| } | |
| } |