Executive brief
The 'trailer' library for the Rust programming language contains a memory management flaw when handling empty data structures. If a developer uses this library to allocate memory for a zero-sized object, it can lead to unpredictable program behavior or crashes. This issue primarily affects the stability of applications using this specific library.
Technical details
The vulnerability exists in the `Trailer::new` constructor within `lib.rs` of the `trailer` crate. The implementation uses an `unsafe` block to call `Trailer::allocate(capacity)` without verifying if the capacity is zero or if the type `T` is a Zero Sized Type (ZST). In Rust, performing allocations with a size of zero via certain low-level routines is considered undefined behavior. An attacker or a malformed program could trigger this by initializing a `Trailer` with a zero capacity or a ZST, potentially leading to memory corruption or a denial-of-service (crash). As of the advisory date, the crate is unmaintained and no patch is available.
Affected products
- Geal trailer <= 0.1.2
Timeline
- 2025-05-04: disclosed: Issue reported on GitHub repository
- 2025-05-09: advisory: GitHub Advisory and CVE published