Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Overview

Two independent soundness problems, both reachable from safe Rust.

Map::into_iter drops builder (the caller-supplied hasher H) and incin by hand, then commits the ownership transfer with mem::forget(self). H::drop is user code and may panic. If it does, mem::forget(self) is skipped and the still-live Map unwinds, whose field drop glue destroys builder a second time. An empty map is enough — no entries or concurrency required.

SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner before taking the real Arc out. Arc has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, self.inner also holds garbage while self is still droppable, so an unwind from incin.clear() or Arc::new decrements a refcount through an uninitialized pointer. The make_shared_incin! macro is instantiated five times, so this covers queue, stack, map, channel::spmc and channel::mpmc.

Impact

• CWE-415 (Double Free): the same allocation is freed twice.
• CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated Drop.
• CWE-908 (Use of Uninitialized Resource): an Arc is constructed from uninitialized bytes.

Fix

No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.

Affected packages

• lockfree >= 0.0.0-0

Remediation

Refer to the advisory for the patched release.