Advisories for Cargo/Ic_cdk package

2024

ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

When a canister method is called via ic_cdk::call*, a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is …