{"id":"GHSA-h7h7-6mx3-r89v","aliases":["RUSTSEC-2024-0435"],"status":"published","title":"Fyrox has unsound usages of `Vec::from_raw_parts`","description":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-12-19T12:00:00Z","modified":"2026-09-10T03:50:22Z","fixes":[{"ecosystem":"crates.io","package":"fyrox-core","fixed_in":["0.36","0.36.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"fyrox-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.1"},{"fixed":"0.36"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fyrox-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.1"},{"fixed":"0.36"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fyrox-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.36.0"}]}]}],"references":[{"url":"https://github.com/FyroxEngine/Fyrox/issues/630","tags":["web","report"]},{"url":"https://github.com/FyroxEngine/Fyrox/pull/662","tags":["web"]},{"url":"https://github.com/FyroxEngine/Fyrox/commit/474e3b01a884366cdb7d704f7456ef692e992232","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0435.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h7h7-6mx3-r89v"},{"url":"https://github.com/FyroxEngine/Fyrox","tags":["package"]},{"url":"https://crates.io/crates/fyrox-core","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-h7h7-6mx3-r89v","title":"Fyrox has unsound usages of `Vec::from_raw_parts` ","description":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","status":"published","published":"2025-02-14T17:31:16Z","modified":"2025-02-14T17:31:17Z","updated_at":"2026-11-02T14:38:31.416868Z"}],"osv":[{"id":"GHSA-h7h7-6mx3-r89v","title":"Fyrox has unsound usages of `Vec::from_raw_parts` ","description":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","status":"published","published":"2025-02-14T17:31:16Z","modified":"2026-09-10T03:50:22.753279979Z","updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RUSTSEC-2024-0435","title":"Unsound usages of `Vec::from_raw_parts`","description":"The library provides a public safe API `transmute_vec_as_bytes`, which incorrectly assumes that any generic type `T` could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as `T` and cast it to `u8` pointer.  \n\nIn the [issue](https://github.com/FyroxEngine/Fyrox/issues/630), we develop a PoC to show passing struct type to `transmute_vec_as_bytes` could lead to undefined behavior with `Vec::from_raw_parts`.  \n\nThe developers provide a patch by changing trait of `Copy` to `Pod`, which can make sure `T` should be plain data. This was patched in the latest version of [master](https://github.com/FyroxEngine/Fyrox/blob/3f9ad6f9667047dac051b0e97d544e5b38e5ae72/fyrox-core/src/lib.rs#L351-L360) branch, but still not on the latest release (0.28.1).","status":"published","published":"2024-12-19T12:00:00Z","modified":"2025-10-28T06:29:25.103174Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}