tokio-1.14.1
tokio-rs/tokiotokio-1.14.1Jan 31, 2022by carllerche
AI Summary
This release backports a critical soundness bug fix from v1.16.1 that addresses an uninitialized memory exposure vulnerability in the `io::Take` implementation.
Key Highlights
- Fixes a soundness bug in `io::Take`
- Prevents exposure of uninitialized memory in edge cases
Full Release Notes
This release backports a bug fix from 1.16.1
Fixes a soundness bug in `io::Take` ([#4428]). The unsoundness is exposed when
leaking memory in the given `AsyncRead` implementation and then overwriting the
supplied buffer:
```rust
impl AsyncRead for Buggy {
fn poll_read(
self: Pin<&mut Self>,
cx: &mut Context<'_>,
buf: &mut ReadBuf<'_>
) -> Poll<Result<()>> {
let new_buf = vec![0; 5].leak();
*buf = ReadBuf::new(new_buf);
buf.put_slice(b"hello");
Poll::Ready(Ok(()))
}
}
```
### Fixed
- io: **soundness** don't expose uninitialized memory when using `io::Take` in edge case ([#4428])
[#4428]: https://github.com/tokio-rs/tokio/pull/4428