{"id":"GHSA-5x36-7567-3cw6","aliases":["RUSTSEC-2023-0016"],"status":"published","title":"partial_sort contains Out-of-bounds Read in release mode","description":"Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.\n\nAll writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.\n\nThe accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector.\n\nThis bug has been fixed in v0.2.0.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-02-20T12:00:00Z","modified":"2023-11-08T04:15:57Z","fixes":[{"ecosystem":"crates.io","package":"partial_sort","fixed_in":["0.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"partial_sort","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"partial_sort","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"partial_sort","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}]}],"references":[{"url":"https://github.com/sundy-li/partial_sort/issues/7","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0016.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5x36-7567-3cw6"},{"url":"https://github.com/sundy-li/partial_sort","tags":["package"]},{"url":"https://crates.io/crates/partial_sort","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-5x36-7567-3cw6","title":"partial_sort contains Out-of-bounds Read in release mode","description":"Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.\n\nAll writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.\n\nThe accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector.\n\nThis bug has been fixed in v0.2.0.\n","status":"published","published":"2023-02-28T20:31:05Z","modified":"2023-02-28T20:31:06Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"osv":[{"id":"GHSA-5x36-7567-3cw6","title":"partial_sort contains Out-of-bounds Read in release mode","description":"Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.\n\nAll writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.\n\nThe accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector.\n\nThis bug has been fixed in v0.2.0.\n","status":"published","published":"2023-02-28T20:31:05Z","modified":"2023-11-08T04:15:57.343834Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RUSTSEC-2023-0016","title":"Possible out-of-bounds read in release mode","description":"Affected versions of this crate were using a debug assertion to validate the\n`last` parameter of `partial_sort()`. This would allow invalid inputs to cause\nan out-of-bounds read instead of immediately panicking, when compiled without\ndebug assertions.\n\nAll writes are bounds-checked, so the out-of-bounds memory access is read-only.\nThis also means that the first attempted out-of-bounds write will panic,\nlimiting the possible reads.\n\nThe accessible region is further limited by an initial bounds-checked read\nat `(last / 2) - 1`, i.e., it is proportional to the size of the vector.\n\nThis bug has been fixed in v0.2.0.","status":"published","published":"2023-02-20T12:00:00Z","modified":"2023-11-08T04:15:57.343834Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}