{"id":"RUSTSEC-2025-0164","aliases":[],"status":"published","title":"`DTriangle` accessors may read out of bounds in affected versions","description":"In affected versions, `DTriangle::neighbor_by_order` and `DTriangle::vertex_by_order` were public safe functions that accepted an\narbitrary `order` value. These functions used `order` to access fixed-size internal arrays with `get_unchecked`, without checking whether `order` was within bounds. Calling these methods with an out-of-bounds `order` could cause an out-of-bounds read from safe Rust code. This made the old APIs unsound, since safe callers could trigger undefined behavior without using `unsafe`.\n\nThe issue was fixed in version `0.29.0` as part of a broader rewrite that replaced the old triangle implementation with `IntTriangle` and removed the affected accessor methods.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-04-24T12:00:00Z","modified":"2026-06-23T11:30:04Z","fixes":[{"ecosystem":"crates.io","package":"i_triangle","fixed_in":["0.29.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"i_triangle","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.29.0"}]}]}],"references":[{"url":"https://crates.io/crates/i_triangle","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0164.html","tags":["advisory"]},{"url":"https://github.com/iShape-Rust/iTriangle/issues/4","tags":["report"]},{"url":"https://github.com/iShape-Rust/iTriangle/commit/13e0e9f4d5333e3a815191e5f6f402641997f91b","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2025-0164","title":"`DTriangle` accessors may read out of bounds in affected versions","description":"In affected versions, `DTriangle::neighbor_by_order` and `DTriangle::vertex_by_order` were public safe functions that accepted an\narbitrary `order` value. These functions used `order` to access fixed-size internal arrays with `get_unchecked`, without checking whether `order` was within bounds. Calling these methods with an out-of-bounds `order` could cause an out-of-bounds read from safe Rust code. This made the old APIs unsound, since safe callers could trigger undefined behavior without using `unsafe`.\n\nThe issue was fixed in version `0.29.0` as part of a broader rewrite that replaced the old triangle implementation with `IntTriangle` and removed the affected accessor methods.","status":"published","published":"2025-04-24T12:00:00Z","modified":"2026-06-23T11:30:04.212001361Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}