An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Smallvec | Servo | 0.6.5 (including) | 0.6.10 (excluding) |
| Rust-smallvec | Ubuntu | disco | * |
| Rust-smallvec | Ubuntu | trusty | * |
| Rust-smallvec | Ubuntu | upstream | * |