`maligned::align_first` is unsound
Open
Nobody has claimed this yet.
Unmaintained
Unsound
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
The align_first function of the maligned crate manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
As per the stdlib documentation this violates the GlobalAlloc::dealloc safety contract and causes undefined behaviour, since the allocation has to have the exact same allocation as T.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the maligned crate's align_first documentation and the linked Rust Vec::from_raw_parts and GlobalAlloc safety requirements. The issue names no repository files, tests, or concrete change, so determine the expected advisory-database entry and its validation steps before proceeding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100