Update SmallVec to 1.6.1

Fixes a buffer overflow: servo/rust-smallvec#252. `spinoso-array` is not impacted because it does not use the vulnerable `SmallVec::insert_many` API.
artichoke · Jan 8, 2021 · cc127a4 · cc127a4
1 parent c34ed16
commit cc127a4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/spinoso-array/Cargo.toml b/spinoso-array/Cargo.toml
@@ -15,7 +15,9 @@ categories = ["data-structures", "no-std"]
 [dependencies]
 # 1.4.1 fixed UB when allocating zero-bytes for ZST element types.
 # https://github.com/servo/rust-smallvec/releases/tag/v1.4.1
-smallvec = { version = "1, >= 1.4.1", optional = true }
+# 1.6.1 fixed a buffer overflow when calling `SmallVec::insert_many`.
+# https://github.com/servo/rust-smallvec/issues/252
+smallvec = { version = "1, >= 1.6.1", optional = true }
 
 [features]
 default = ["small-array"]