Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.
Uint shift operations: incorrect overflow flags and truncated shift amounts
Uint::overflowing_shl/overflowing_shr returned false-negative overflow
flags. overflowing_shl missed bits shifted above BITS but within the top
limb (non-limb-aligned widths such as U160), and limbs wholly discarded by
shifts >= 64; overflowing_shr missed wholly discarded low limbs. Shifted
values were correct; only the flag was wrong.
The wrong flag propagates: checked_shl/checked_shr return Some instead
of None, strict_* fail to panic, and saturating_* return a wrapped
value instead of saturating. The incorrect checked_shl result causes
to_base_be (and string formatting) to loop forever on no-alloc builds for
non-limb-aligned widths — a denial of service if formatting is reachable
from untrusted input.
Separately, wrapping_shl/wrapping_shr on 64/128/256-bit types truncated
the shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly
wrapped value instead of zero; on 32-bit targets the generic path also
truncated 64-bit shift amounts.
Callers using checked or saturating shift semantics on untrusted shift
amounts may compute incorrect results.
GHSA-9fjq-45qv-pcm7
RUSTSEC-2025-0137
Dec 26, 2025
ruint affected by unsoundness of safe `reciprocal_mg10`
Medium
Network
Low
None
None
The function reciprocal_mg10 is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on debug_assert! for safety checks instead of assert!.
When compiled in release mode, the debug_assert! is optimized out, potentially allowing invalid inputs to cause memory corruption.