Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tokio-rs/slab
master @ a1e4346
9
Fixes
1
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Memory Corruption: 4 prior fixes. Scrutinize any change in this area.
src/lib.rs: most-fixed (9 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Validating input indices against total capacity instead of the collection's actual length allows callers to reference uninitialized memory slots, leading to undefined behavior or mutable aliasing. This class of bug is exemplified by CVE-2025-55159.
Memory Safety: Creating sequential exclusive mutable references inside unsafe blocks can trigger Stacked Borrows violations and compiler-induced undefined behavior. Accesses to underlying entries must use direct raw pointer arithmetic from the base array pointer instead.
Memory Corruption: Desynchronization of the internal length counter (such as underflows or failure to increment on replacement) breaks safe wrappers' assumptions, allowing safe API users to trigger out-of-bounds reads and writes.