Deps.rs

amethyst_renderer 0.10.4

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate amethyst_renderer

Dependencies

(33 total, 20 outdated, 2 insecure)

CrateRequiredLatestStatus
 amethyst_assets^0.6.00.15.3out of date
 amethyst_core^0.5.00.15.3out of date
 amethyst_derive^0.3.00.15.3out of date
 derivative^1.02.2.0out of date
 error-chain^0.120.12.4up to date
 fnv^1.01.0.7up to date
 genmesh^0.60.6.2up to date
 gfx^0.17.10.18.3out of date
 gfx_core^0.8.30.9.2out of date
 gfx_device_dx11^0.70.8.2out of date
 gfx_device_gl^0.150.16.2out of date
 gfx_device_metal^0.30.3.0up to date
 gfx_device_vulkan^0.10.1.0up to date
 gfx_macros^0.20.2.1up to date
 gfx_window_dxgi^0.170.19.1out of date
 gfx_window_glutin^0.27.00.31.0out of date
 gfx_window_metal^0.60.6.0up to date
 gfx_window_vulkan^0.10.1.0up to date
 glsl-layout ⚠️^0.1.10.5.0insecure
 glutin^0.190.32.3out of date
 hetseq^0.2.00.2.0up to date
 hibitset^0.5.10.6.4out of date
 image ⚠️^0.200.25.10insecure
 log^0.4.60.4.34up to date
 rayon^1.0.21.12.0up to date
 ron^0.40.12.2out of date
 serde^11.0.229up to date
 shred^0.70.16.1out of date
 shred-derive^0.50.7.0out of date
 smallvec^0.61.16.2out of date
 thread_profiler^0.30.3.0up to date
 wavefront_obj^5.111.0.0out of date
 winit^0.180.30.13out of date

Security Vulnerabilities

image: Flaw in interface may drop uninitialized instance of arbitrary types

RUSTSEC-2019-0014

Affected versions of this crate would call Vec::set_len on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances.

This could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.

Two different fixes were applied. It is possible to conserve the interface by ensuring proper initialization before calling Vec::set_len. Drop is no longer called in case of panic, though.

Starting from version 0.22, a breaking change to the interface requires callers to pre-allocate the output buffer and pass a mutable slice instead, avoiding all unsafe code.

glsl-layout: Double drop upon panic in 'fn map_array()'

RUSTSEC-2021-0005

Affected versions of this crate did not guard against panic within the user-provided function f (2nd parameter of fn map_array), and thus panic within f causes double drop of a single object.

The flaw was corrected in the 0.4.0 release by wrapping the object vulnerable to a double drop within ManuallyDrop<T>.