Repository navigation
Check UniformChar validity on deser - #1790
Merged
Merged
Conversation
1 task done
dhardy
force-pushed
the
push-knozkvkrvwvk
branch
from
June 18, 2026 12:31
f8a79db to
1916448
Compare
newpavlov
approved these changes
Jun 24, 2026
newpavlov
reviewed
Jun 24, 2026
This was referenced Jul 2, 2026
dhardy
added a commit
that referenced
this pull request
Jul 3, 2026
Prevent memory safety violation in `UniformChar` via deserialization.
kodiakhq Bot
pushed a commit
to pdylanross/fatigue
that referenced
this pull request
Jul 3, 2026
Bumps rand from 0.10.1 to 0.10.2. Changelog Sourced from rand's changelog. [0.10.2] — 2026-07-02 Fixes Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790) Changes Document required output order of fn partial_shuffle and apply #[must_use] (#1769) Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791) #1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791 Commits 1540ea3 Prepare rand 0.10.2 (#1800) a29964a Bump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (#1801) ced9491 Tweak docs for RngExt::random_range and SampleRange (#1798) db14664 Check UniformChar validity on deser (#1790) bea8620 Bump the all-deps group with 2 updates (#1796) 4f44932 Bump actions/cache from 5 to 6 (#1795) b999a13 Bump actions/checkout from 6 to 7 (#1794) aeab810 Avoid unsafe where safety depends on non-local values (#1791) 1896d7c Add typos CI job (#1789) 43eddee Bump the all-deps group with 2 updates (#1788) Additional commits viewable in compare view Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dhardy
added a commit
that referenced
this pull request
Jul 11, 2026
dhardy
added a commit
that referenced
this pull request
Jul 11, 2026
This was referenced Jul 18, 2026
1 task
This was referenced Jul 27, 2026
|
@dhardy Does this need an unsoundness advisory at https://github.com/rustsec/advisory-db? |
1 task
This was referenced Jul 29, 2026
Member
Author
1 task done
xtqqczze
added a commit
to xtqqczze/pendulum-project-ntpd-rs
that referenced
this pull request
Sep 9, 2026
Upgrade the`rand` crate to updated 0.8 and 0.10 versions that address the unsoundness present in the current releases. See rust-random/rand#1790 for details.
pull Bot
pushed a commit
to xtqqczze/pendulum-project-ntpd-rs
that referenced
this pull request
Sep 10, 2026
Upgrade the`rand` crate to updated 0.8 and 0.10 versions that address the unsoundness present in the current releases. See rust-random/rand#1790 for details.
renovate Bot
added a commit
to gwennlbh/shapemaker
that referenced
this pull request
Sep 27, 2026
##### [v0.10.3](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0103--2026-09-20) ##### Fixes - Fix `WeightedIndex` panic when the sum of float weights is infinite; return `Error::Overflow` instead ([#1808]) - Fix spurious `Error::NonFinite` from `Uniform::new_inclusive` on large finite float ranges such as `0.0..=f64::MAX` ([#1821]) - Fix possible panic due to sampling a deserialized `Uniform<char>` ([#1831]) ##### Changes - Report exact remaining lengths from `WeightedIndex::weights()` and reduce overhead when reading weights ([#1838]) [#1808]: rust-random/rand#1808 [#1821]: rust-random/rand#1821 [#1831]: rust-random/rand#1831 [#1838]: rust-random/rand#1838 ##### [v0.10.2](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0102--2026-07-02) ##### Fixes - Fix possible memory safety violation due to deserialization of `UniformChar` from bad source ([#1790]) ##### Changes - Document required output order of fn `partial_shuffle` and apply `#[must_use]` ([#1769]) - Avoid usage of `unsafe` in contexts where non-local memory corruption could invalidate contract ([#1791]) [#1769]: rust-random/rand#1769 [#1790]: rust-random/rand#1790 [#1791]: rust-random/rand#1791 ##### [v0.10.1](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0101--2026-02-11) This release includes a fix for a soundness bug; see [#1763]. ##### Changes - Document panic behavior of `make_rng` and add `#[track_caller]` ([#1761]) - Deprecate feature `log` ([#1763]) [#1761]: rust-random/rand#1761 [#1763]: rust-random/rand#1763 ##### [v0.10.0](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0100---2026-02-08) ##### Changes - The dependency on `rand_chacha` has been replaced with a dependency on `chacha20`. This changes the implementation behind `StdRng`, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in `chacha20` instead of `rand_chacha` ([#1642]). - Rename fns `IndexedRandom::choose_multiple` -> `sample`, `choose_multiple_array` -> `sample_array`, `choose_multiple_weighted` -> `sample_weighted`, struct `SliceChooseIter` -> `IndexedSamples` and fns `IteratorRandom::choose_multiple` -> `sample`, `choose_multiple_fill` -> `sample_fill` ([#1632]) - Use Edition 2024 and MSRV 1.85 ([#1653]) - Let `Fill` be implemented for element types, not sliceable types ([#1652]) - Fix `OsError::raw_os_error` on UEFI targets by returning `Option<usize>` ([#1665]) - Replace fn `TryRngCore::read_adapter(..) -> RngReadAdapter` with simpler struct `RngReader` ([#1669]) - Remove fns `SeedableRng::from_os_rng`, `try_from_os_rng` ([#1674]) - Remove `Clone` support for `StdRng`, `ReseedingRng` ([#1677]) - Use `postcard` instead of `bincode` to test the serde feature ([#1693]) - Avoid excessive allocation in `IteratorRandom::sample` when `amount` is much larger than iterator size ([#1695]) - Rename `os_rng` -> `sys_rng`, `OsRng` -> `SysRng`, `OsError` -> `SysError` ([#1697]) - Rename `Rng` -> `RngExt` as upstream `rand_core` has renamed `RngCore` -> `Rng` ([#1717]) ##### Additions - Add fns `IndexedRandom::choose_iter`, `choose_weighted_iter` ([#1632]) - Pub export `Xoshiro128PlusPlus`, `Xoshiro256PlusPlus` prngs ([#1649]) - Pub export `ChaCha8Rng`, `ChaCha12Rng`, `ChaCha20Rng` behind `chacha` feature ([#1659]) - Fn `rand::make_rng() -> R where R: SeedableRng` ([#1734]) ##### Removals - Removed `ReseedingRng` ([#1722]) - Removed unused feature "nightly" ([#1732]) - Removed feature `small_rng` ([#1732]) [#1632]: rust-random/rand#1632 [#1642]: rust-random/rand#1642 [#1649]: rust-random/rand#1649 [#1652]: rust-random/rand#1652 [#1653]: rust-random/rand#1653 [#1659]: rust-random/rand#1659 [#1665]: rust-random/rand#1665 [#1669]: rust-random/rand#1669 [#1674]: rust-random/rand#1674 [#1677]: rust-random/rand#1677 [#1693]: rust-random/rand#1693 [#1695]: rust-random/rand#1695 [#1697]: rust-random/rand#1697 [#1717]: rust-random/rand#1717 [#1722]: rust-random/rand#1722 [#1732]: rust-random/rand#1732 [#1734]: rust-random/rand#1734 ##### [v0.9.5](https://github.com/rust-random/rand/releases/tag/0.9.5) #### What's Changed - rand v0.9.5: backport [#1790](rust-random/rand#1790) by [@dhardy](https://github.com/dhardy) in [#1803](rust-random/rand#1803) **Full Changelog**: <rust-random/rand@0.9.4...0.9.5> ##### [v0.9.4](https://github.com/rust-random/rand/releases/tag/0.9.4) ##### Fixes - Fix doc build ([#1766]) [#1766]: rust-random/rand#1766 **Full Changelog**: <rust-random/rand@0.9.3...0.9.4> ##### [v0.9.3](rust-random/rand@0.9.2...0.9.3)
markharding
pushed a commit
to futo-org/Harbor
that referenced
this pull request
Oct 13, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rand](https://rust-random.github.io/book) ([source](https://github.com/rust-random/rand)) | dependencies | patch | `0.10.1` → `0.10.3` | --- ### Release Notes <details> <summary>rust-random/rand (rand)</summary> ### [`v0.10.3`](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0103--2026-09-20) [Compare Source](rust-random/rand@0.10.2...0.10.3) ##### Fixes - Fix `WeightedIndex` panic when the sum of float weights is infinite; return `Error::Overflow` instead ([#​1808]) - Fix spurious `Error::NonFinite` from `Uniform::new_inclusive` on large finite float ranges such as `0.0..=f64::MAX` ([#​1821]) - Fix possible panic due to sampling a deserialized `Uniform<char>` ([#​1831]) ##### Changes - Report exact remaining lengths from `WeightedIndex::weights()` and reduce overhead when reading weights ([#​1838]) [#​1808]: rust-random/rand#1808 [#​1821]: rust-random/rand#1821 [#​1831]: rust-random/rand#1831 [#​1838]: rust-random/rand#1838 ### [`v0.10.2`](https://github.com/rust-random/rand/blob/HEAD/CHANGELOG.md#0102--2026-07-02) [Compare Source](rust-random/rand@0.10.1...0.10.2) ##### Fixes - Fix possible memory safety violation due to deserialization of `UniformChar` from bad source ([#​1790]) ##### Changes - Document required output order of fn `partial_shuffle` and apply `#[must_use]` ([#​1769]) - Avoid usage of `unsafe` in contexts where non-local memory corruption could invalidate contract ([#​1791]) [#​1769]: rust-random/rand#1769 [#​1790]: rust-random/rand#1790 [#​1791]: rust-random/rand#1791 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEzMy4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==--> Co-authored-by: Thomas de Zeeuw <thomas@futo.org> Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1792 Reviewed-by: Thomas de Zeeuw <thomas@futo.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGELOG.mdentrySummary
Prevent memory safety violation in
UniformCharvia deserialization.