grid

Version	Released
`1.0.1` unknown	Apr 20, 2026
`1.0.0` unknown 1 CVE	Aug 31, 2025
`0.18.0` unknown 1 CVE	Jun 17, 2025
`0.17.0` unknown 1 CVE	May 20, 2025
`0.16.2` unknown	Apr 18, 2025
`0.16.1` unknown	Feb 04, 2025
`0.16.0` unknown	Jan 22, 2025
`0.15.0` unknown	Sep 22, 2024
`0.14.0` unknown	May 15, 2024
`0.13.0` unknown	Dec 18, 2023
`0.12.0` unknown	Nov 22, 2023
`0.11.0` unknown	Sep 11, 2023
`0.10.0` unknown	May 01, 2023
`0.9.0` unknown	Oct 07, 2022
`0.8.1` unknown	Aug 17, 2022
`0.8.0` unknown	Aug 16, 2022
`0.7.0` unknown	Aug 06, 2022
`0.6.0` unknown	Nov 05, 2021
`0.5.0` unknown	Aug 22, 2021
`0.4.0` unknown	Jul 23, 2021
`0.3.0` unknown	May 25, 2021
`0.2.3` unknown	Apr 24, 2020
`0.2.2` unknown	Apr 24, 2020
`0.2.1` unknown	Apr 06, 2020
`0.2.0` unknown	Apr 06, 2020
`0.1.1` unknown	Dec 23, 2017
`0.1.0` unknown	Dec 23, 2017

1.0.1 unknown

Apr 20, 2026

1.0.0 unknown

1 CVE

CVE-2026-42199 GHSA-38c5-483c-4qqp Apr 24, 2026

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

6.2 / 10

Medium

Local Low None None Unchanged None None High

Summary

An integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior.

Details

Tested Version: grid = "1.0.0"

expand_rows() computes the new backing length using unchecked arithmetic:

self.data.len() + rows * self.cols

If rows * self.cols or the subsequent addition overflows usize, the result wraps in release builds and self.data may be resized to a length much smaller than logically required.

After that, if the grid is in ColumnMajor order, the function performs in-place rotation using indices derived from:

let total_rows = self.rows + row_added;
let col_idx = i * total_rows;
self.data[col_idx..col_idx + total_rows + i].rotate_right(i);

These computations also rely on the assumption that the backing storage has been resized to the correct length. Once the earlier length computation has wrapped, this assumption no longer holds, so the function may operate on invalid ranges or otherwise enter an inconsistent state.

Finally, the function updates logical metadata with:

self.rows += rows;

As a result, the grid can end up with logical dimensions that no longer match the actual backing storage. Subsequent safe API calls such as get() may then rely on corrupted metadata and reach unsafe internal accesses, resulting in invalid unchecked access and Undefined Behavior.

PoC

#![forbid(unsafe_code)]

use grid::Grid;

fn main() {
    let mut g = Grid::from_vec(vec![1u8, 2u8], 2);

    g.expand_rows(usize::MAX / 2);

    g.get(0, 0); // triggers UB in get_unchecked
}

Impact

Invalid unchecked access (get_unchecked) reached via safe API
Confirmed by Miri (release-mode):

error: Undefined Behavior: `assume` called with `false`
   --> ..../grid-1.0.0/src/lib.rs:527:9
    |
527 |         self.data.get_unchecked(index)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here

Potential crash / denial of service in release-builds (e.g., SIGSEGV, Illegal instruction)
Violates Rust’s safety guarantees despite using only safe code

Fixed in


          1.0.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 31, 2025

0.18.0 unknown

1 CVE

CVE-2026-42199 GHSA-38c5-483c-4qqp Apr 24, 2026

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

6.2 / 10

Medium

Local Low None None Unchanged None None High

Summary

An integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior.

Details

Tested Version: grid = "1.0.0"

expand_rows() computes the new backing length using unchecked arithmetic:

self.data.len() + rows * self.cols

If rows * self.cols or the subsequent addition overflows usize, the result wraps in release builds and self.data may be resized to a length much smaller than logically required.

After that, if the grid is in ColumnMajor order, the function performs in-place rotation using indices derived from:

let total_rows = self.rows + row_added;
let col_idx = i * total_rows;
self.data[col_idx..col_idx + total_rows + i].rotate_right(i);

These computations also rely on the assumption that the backing storage has been resized to the correct length. Once the earlier length computation has wrapped, this assumption no longer holds, so the function may operate on invalid ranges or otherwise enter an inconsistent state.

Finally, the function updates logical metadata with:

self.rows += rows;

As a result, the grid can end up with logical dimensions that no longer match the actual backing storage. Subsequent safe API calls such as get() may then rely on corrupted metadata and reach unsafe internal accesses, resulting in invalid unchecked access and Undefined Behavior.

PoC

#![forbid(unsafe_code)]

use grid::Grid;

fn main() {
    let mut g = Grid::from_vec(vec![1u8, 2u8], 2);

    g.expand_rows(usize::MAX / 2);

    g.get(0, 0); // triggers UB in get_unchecked
}

Impact

Invalid unchecked access (get_unchecked) reached via safe API
Confirmed by Miri (release-mode):

error: Undefined Behavior: `assume` called with `false`
   --> ..../grid-1.0.0/src/lib.rs:527:9
    |
527 |         self.data.get_unchecked(index)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here

Potential crash / denial of service in release-builds (e.g., SIGSEGV, Illegal instruction)
Violates Rust’s safety guarantees despite using only safe code

Fixed in


          1.0.1

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 17, 2025

0.17.0 unknown

1 CVE

CVE-2026-42199 GHSA-38c5-483c-4qqp Apr 24, 2026

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

6.2 / 10

Medium

Local Low None None Unchanged None None High

Summary

An integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior.

Details

Tested Version: grid = "1.0.0"

expand_rows() computes the new backing length using unchecked arithmetic:

self.data.len() + rows * self.cols

If rows * self.cols or the subsequent addition overflows usize, the result wraps in release builds and self.data may be resized to a length much smaller than logically required.

After that, if the grid is in ColumnMajor order, the function performs in-place rotation using indices derived from:

let total_rows = self.rows + row_added;
let col_idx = i * total_rows;
self.data[col_idx..col_idx + total_rows + i].rotate_right(i);

These computations also rely on the assumption that the backing storage has been resized to the correct length. Once the earlier length computation has wrapped, this assumption no longer holds, so the function may operate on invalid ranges or otherwise enter an inconsistent state.

Finally, the function updates logical metadata with:

self.rows += rows;

As a result, the grid can end up with logical dimensions that no longer match the actual backing storage. Subsequent safe API calls such as get() may then rely on corrupted metadata and reach unsafe internal accesses, resulting in invalid unchecked access and Undefined Behavior.

PoC

#![forbid(unsafe_code)]

use grid::Grid;

fn main() {
    let mut g = Grid::from_vec(vec![1u8, 2u8], 2);

    g.expand_rows(usize::MAX / 2);

    g.get(0, 0); // triggers UB in get_unchecked
}

Impact

Invalid unchecked access (get_unchecked) reached via safe API
Confirmed by Miri (release-mode):

error: Undefined Behavior: `assume` called with `false`
   --> ..../grid-1.0.0/src/lib.rs:527:9
    |
527 |         self.data.get_unchecked(index)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here

Potential crash / denial of service in release-builds (e.g., SIGSEGV, Illegal instruction)
Violates Rust’s safety guarantees despite using only safe code

Fixed in


          1.0.1

References

Updated Sep 10, 2026 · Source: OSV.dev

May 20, 2025

0.16.2 unknown

Apr 18, 2025

0.16.1 unknown

Feb 04, 2025

0.16.0 unknown

Jan 22, 2025

0.15.0 unknown

Sep 22, 2024

0.14.0 unknown

May 15, 2024

0.13.0 unknown

Dec 18, 2023

0.12.0 unknown

Nov 22, 2023

0.11.0 unknown

Sep 11, 2023

0.10.0 unknown

May 01, 2023

0.9.0 unknown

Oct 07, 2022

0.8.1 unknown

Aug 17, 2022

0.8.0 unknown

Aug 16, 2022

0.7.0 unknown

Aug 06, 2022

0.6.0 unknown

Nov 05, 2021

0.5.0 unknown

Aug 22, 2021

0.4.0 unknown

Jul 23, 2021

0.3.0 unknown

May 25, 2021

0.2.3 unknown

Apr 24, 2020

0.2.2 unknown

Apr 24, 2020

0.2.1 unknown

Apr 06, 2020

0.2.0 unknown

Apr 06, 2020

0.1.1 unknown

Dec 23, 2017

0.1.0 unknown

Dec 23, 2017

Activity

Details