CVE-2025-47737

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness. trailer/src/lib.rs, Lines 18 to 25 in d474984: ``` pub fn new(capacity: usize) -> Trailer<T> { unsafe { let trailer = Trailer::allocate(capacity); let ptr = trailer.ptr as *mut T; ptr.write(T::default()); trailer } } ``` The constructor does not check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work: ``` use trailer::Trailer; #[derive(Default)] struct Zst; fn main() { let mut a = Trailer::<Zst>::new(0); drop(a); } ``` The trailer crate is unmaintained and this security issue will not be fixed.

lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.

lib.rs en el contenedor del remolque hasta la versión 0.1.2 para Rust maneja incorrectamente la asignación con un tamaño de cero.