Report::frames_mut allows aliased mutable references
| Details |
|
| Status |
unsound |
| Package |
error-stack |
| Version |
0.5.0 |
| URL |
hashintel/hash#8945 |
| Date |
2026-07-03 |
Affected versions of this crate return an iterator from
Report::frames_mut whose &mut Frame items have lifetimes independent
of the iterator, so all yielded references can be held at the same time.
A yielded frame's sources are also yielded by the iterator and reachable
through the parent frame via Frame::sources_mut, allowing safe code to
obtain two live mutable references to the same frame. This is undefined
behavior and can be used to cause a segmentation fault (see reproducer in
the linked issue). Versions 0.1.0 and 0.1.1 are affected through
Frame::source_mut instead of Frame::sources_mut.
The flaw is fixed in 0.8.0 by replacing the iterator with internal
iteration: Report::frames_mut now takes a visitor closure, so mutable
access to a frame is scoped and cannot overlap with access to its
sources.
See advisory page for additional details.
error-stack0.5.0Affected versions of this crate return an iterator from
Report::frames_mutwhose&mut Frameitems have lifetimes independentof the iterator, so all yielded references can be held at the same time.
A yielded frame's sources are also yielded by the iterator and reachable
through the parent frame via
Frame::sources_mut, allowing safe code toobtain two live mutable references to the same frame. This is undefined
behavior and can be used to cause a segmentation fault (see reproducer in
the linked issue). Versions 0.1.0 and 0.1.1 are affected through
Frame::source_mutinstead ofFrame::sources_mut.The flaw is fixed in 0.8.0 by replacing the iterator with internal
iteration:
Report::frames_mutnow takes a visitor closure, so mutableaccess to a frame is scoped and cannot overlap with access to its
sources.
See advisory page for additional details.