Advisories for Cargo/Lexical package

2023

Multiple soundness issues in lexical

lexical contains multiple soundness issues: Bytes::read() allows creating instances of types with invalid bit patterns BytesIter::read() advances iterators out of bounds The BytesIter trait has safety invariants but is public and not marked unsafe write_float() calls MaybeUninit::assume_init() on uninitialized data, which is is not allowed by the Rust abstract machine radix() calls MaybeUninit::assume_init() on uninitialized data, which is is not allowed by the Rust abstract machine The crate also has …