{"id":"GHSA-rxhx-9fj6-6h2m","aliases":["RUSTSEC-2022-0010"],"status":"published","title":"enum_map macro can cause UB when `Enum` trait is incorrectly implemented","description":"Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.\n\nWhen the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.\n\nThis problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nenum E {\n    A,\n    B,\n    C,\n}\n\nimpl Enum for E {\n    const LENGTH: usize = 2;\n\n    fn from_usize(value: usize) -\u003e E {\n        match value {\n            0 =\u003e E::A,\n            1 =\u003e E::B,\n            2 =\u003e E::C,\n            _ =\u003e unimplemented!(),\n        }\n    }\n\n    fn into_usize(self) -\u003e usize {\n        self as usize\n    }\n}\n\nimpl\u003cV\u003e EnumArray\u003cV\u003e for E {\n    type Array = [V; 3];\n}\n\nlet _map: EnumMap\u003cE, String\u003e = enum_map! { _ =\u003e \"Hello, world!\".into() };\n```\n\nThe flaw was corrected in commit [b824e23](https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-02-17T12:00:00Z","modified":"2023-11-08T04:22:58Z","fixes":[{"ecosystem":"crates.io","package":"enum-map","fixed_in":["2.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"enum-map","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-2"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"enum-map","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-2"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"enum-map","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-2"},{"fixed":"2.0.2"}]}]}],"references":[{"url":"https://github.com/rustsec/advisory-db/blob/main/crates/enum-map/RUSTSEC-2022-0010.md","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0010.html","tags":["web","advisory"]},{"url":"https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc","tags":["web"]},{"url":"https://github.com/xfix/enum-map/blob/master/CHANGELOG.md#version-202","tags":["web"]},{"url":"https://gitlab.com/KonradBorowski/enum-map/-/blob/master/CHANGELOG.md#version-202","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rxhx-9fj6-6h2m"},{"url":"https://github.com/xfix/enum-map","tags":["package"]},{"url":"https://crates.io/crates/enum-map","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-rxhx-9fj6-6h2m","title":"enum_map macro can cause UB when `Enum` trait is incorrectly implemented","description":"Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.\n\nWhen the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.\n\nThis problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nenum E {\n    A,\n    B,\n    C,\n}\n\nimpl Enum for E {\n    const LENGTH: usize = 2;\n\n    fn from_usize(value: usize) -\u003e E {\n        match value {\n            0 =\u003e E::A,\n            1 =\u003e E::B,\n            2 =\u003e E::C,\n            _ =\u003e unimplemented!(),\n        }\n    }\n\n    fn into_usize(self) -\u003e usize {\n        self as usize\n    }\n}\n\nimpl\u003cV\u003e EnumArray\u003cV\u003e for E {\n    type Array = [V; 3];\n}\n\nlet _map: EnumMap\u003cE, String\u003e = enum_map! { _ =\u003e \"Hello, world!\".into() };\n```\n\nThe flaw was corrected in commit [b824e23](https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.\n","status":"published","published":"2022-06-16T23:53:32Z","modified":"2023-06-13T17:27:37Z","updated_at":"2026-11-02T14:36:53.654352Z"}],"osv":[{"id":"GHSA-rxhx-9fj6-6h2m","title":"enum_map macro can cause UB when `Enum` trait is incorrectly implemented","description":"Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.\n\nWhen the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.\n\nThis problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nenum E {\n    A,\n    B,\n    C,\n}\n\nimpl Enum for E {\n    const LENGTH: usize = 2;\n\n    fn from_usize(value: usize) -\u003e E {\n        match value {\n            0 =\u003e E::A,\n            1 =\u003e E::B,\n            2 =\u003e E::C,\n            _ =\u003e unimplemented!(),\n        }\n    }\n\n    fn into_usize(self) -\u003e usize {\n        self as usize\n    }\n}\n\nimpl\u003cV\u003e EnumArray\u003cV\u003e for E {\n    type Array = [V; 3];\n}\n\nlet _map: EnumMap\u003cE, String\u003e = enum_map! { _ =\u003e \"Hello, world!\".into() };\n```\n\nThe flaw was corrected in commit [b824e23](https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.\n","status":"published","published":"2022-06-16T23:53:32Z","modified":"2023-11-08T04:22:58.71967Z","updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RUSTSEC-2022-0010","title":"enum_map macro can cause UB when `Enum` trait is incorrectly implemented","description":"Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.\n\nWhen the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.\n\nThis problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.\n\nExample code that triggers this vulnerability looks like this:\n\n```rust\nenum E {\n    A,\n    B,\n    C,\n}\n\nimpl Enum for E {\n    const LENGTH: usize = 2;\n\n    fn from_usize(value: usize) -\u003e E {\n        match value {\n            0 =\u003e E::A,\n            1 =\u003e E::B,\n            2 =\u003e E::C,\n            _ =\u003e unimplemented!(),\n        }\n    }\n\n    fn into_usize(self) -\u003e usize {\n        self as usize\n    }\n}\n\nimpl\u003cV\u003e EnumArray\u003cV\u003e for E {\n    type Array = [V; 3];\n}\n\nlet _map: EnumMap\u003cE, String\u003e = enum_map! { _ =\u003e \"Hello, world!\".into() };\n```\n\nThe flaw was corrected in commit [b824e23](https://gitlab.com/KonradBorowski/enum-map/-/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.","status":"published","published":"2022-02-17T12:00:00Z","modified":"2023-11-08T04:22:58.71967Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}