advisory-db icon indicating copy to clipboard operation
advisory-db copied to clipboard

Published 20 hours ago • verified publisher icon rustsec

The `sync-read-txn` feature of heed all the v0.10 is unsound

Open Kerollmops opened this issue 10 months ago • 3 comments

A contributor recently discovered that heed's sync-read-txn feature is unsound and should not exist. This feature was implementing Sync on the RoTxn struct, but in fact, it should have only implemented Send. I explained the different implications in an issue comment.

I replaced this feature with the correct read-txn-no-tls, which makes the RoTxn: Send. According to the LMDB documentation and Howard Chu's comments, it is correct to do that. Unfortunately, this change is not yet available as I am working on a big refactor. However, it will be available in v0.20.0.

What should I do? Should I yank all the heed versions even if only a specific feature is affected?

Kerollmops avatar Aug 23 '23 08:08 Kerollmops