Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rust-lang/futures-rs

              main @ fece303
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Memory Safety: 2 prior fixes. Scrutinize any change in this area.

futures-core/src/stream/stream_obj.rs: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Use After Free: Future panics during drop can release task reference counts prematurely, leading to use-after-free.

Memory Corruption: Unsafe `set_len` without bounds check allows a malicious reader to write out-of-bounds.

Use-After-Free: `Pin<Box>` dropped while raw pointer still in use causes use-after-free.