RUSTSEC-2020-0048: Use-after-free in BodyStream due to lack of pinning #1
Description
Use-after-free in BodyStream due to lack of pinning
| Details | |
|---|---|
| Package | actix-http |
| Version | 3.0.0-beta.5 |
| URL | actix/actix-web#1321 |
| Date | 2020-01-24 |
| Patched versions | >=2.0.0-alpha.1 |
Affected versions of this crate did not require the buffer wrapped in BodyStream to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.
The flaw was corrected by making the trait MessageBody require Unpin
and making poll_next() function accept Pin<&mut Self> instead of &mut self.
See advisory page for additional details.