tokio-1.14.1

tokio-rs/tokiotokio-1.14.1Jan 31, 2022by carllerche

AI Summary

This release backports a critical soundness bug fix from v1.16.1 that addresses an uninitialized memory exposure vulnerability in the `io::Take` implementation.

Key Highlights

  • Fixes a soundness bug in `io::Take`
  • Prevents exposure of uninitialized memory in edge cases

Full Release Notes

This release backports a bug fix from 1.16.1

Fixes a soundness bug in `io::Take` ([#4428]). The unsoundness is exposed when
leaking memory in the given `AsyncRead` implementation and then overwriting the
supplied buffer:

```rust
impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}
```

### Fixed

- io: **soundness** don't expose uninitialized memory when using `io::Take` in edge case ([#4428])

[#4428]: https://github.com/tokio-rs/tokio/pull/4428