[MJUCOM]

Affected crate(s)

caja (~5.5k total downloads on crates.io) — all versions before 0.3.2

Links to upstream issue(s) or PR(s)

• Upstream issue: Unsoundness: an empty Caja passes a null pointer to dealloc and slice::from_raw_parts EmanuelGCC/Caja#2
• Fix commit: 40833c4
• Fix release: 0.3.2 (2026-11-02)

Severity

An empty Caja stores a null data pointer, and every safe constructor reaches it
for size 0: Caja::new(0, x), Caja::from(&[]) and clone() of an empty Caja.
Drop then passes that null pointer to dealloc, and as_slice(), as_mut_slice()
and Debug pass it to slice::from_raw_parts. Both are undefined behavior; a debug
build aborts on the standard library's precondition check and Miri reports it at
src/lib.rs:130.

Filed as a soundness issue: no unsafe is required from the caller, and the effect
is undefined behavior on a null pointer, not a demonstrated memory corruption.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

At 42 recent downloads (the pull request template asked for recent downloads, not all-time downloads), this crate doesn't meet our notability criteria:

#wg-secure-code > Minimum notability criteria?