CVE-2025-47737

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness.

trailer/src/lib.rs, Lines 18 to 25 in d474984:

 pub fn new(capacity: usize) -> Trailer<T> { 
     unsafe { 
         let trailer = Trailer::allocate(capacity); 
         let ptr = trailer.ptr as *mut T; 
         ptr.write(T::default()); 
         trailer 
     } 
 } 

The constructor does not check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work:

use trailer::Trailer;
#[derive(Default)]
struct Zst;

fn main() {
    let mut a = Trailer::<Zst>::new(0);
    drop(a);
}

The trailer crate is unmaintained and this security issue will not be fixed.