Improve registry value
return types (#10806)
#11
GitHub Actions / Security audit
succeeded
Oct 25, 2023 in 0s
Security advisories found
1 unsound
Details
Warnings
RUSTSEC-2023-0055
Multiple soundness issues
Details | |
---|---|
Status | unsound |
Package | lexical |
Version | 6.1.1 |
Date | 2023-09-03 |
lexical
contains multiple soundness issues:
- Bytes::read() allows creating instances of types with invalid bit patterns
- BytesIter::read() advances iterators out of bounds
- The
BytesIter
trait has safety invariants but is public and not markedunsafe
write_float()
callsMaybeUninit::assume_init()
on uninitialized data, which is is not allowed by the Rust abstract machine
The crate also has some correctness issues and appears to be unmaintained.
Alternatives
For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorith by the author of lexical
has been merged into libcore.
For quickly parsing integers, consider atoi
and btoi
crates (100% safe code). atoi_radix10
provides even faster parsing, but only with -C target-cpu=native
, and at the cost of some unsafe
.
For formatting integers in a #[no_std]
context consider the numtoa
crate.
For working with big numbers consider num-bigint
and num-traits
.
Loading