{
 "item_id": "ker-toodee_drain",
 "kernel": "toodee_drain",
 "advisory": "RUSTSEC-2025-0062",
 "crate": "toodee",
 "pre_version": "0.5.0",
 "post_version": "0.6.0",
 "advisory_url": "https://github.com/antonmarsden/toodee/issues/26",
 "title": "Heap Buffer Overflow in the DrainCol Destructor",
 "source_file": "src/toodee.rs",
 "function": "drain_col_copy_len",
 "signature": "pub fn drain_col_copy_len(orig_cols: usize, col: usize) -> usize",
 "spec_doc": "When removing column col from a row of orig_cols cells, the number of cells to shift left: those strictly after col (orig_cols - col - 1).",
 "bug_class": "overflow",
 "fidelity": "verbatim_logic",
 "extraction_note": "src/toodee.rs DrainCol::drop: ptr::copy length off by one (heap overflow)",
 "witness_args": "5usize, 2usize",
 "labels": {
  "buggy": "toodee@0.5.0",
  "reference": "toodee@0.6.0"
 }
}