Skip to content

Commit b0ba734

Browse files
celinvalcelinval
authored
Replace vector-map by linear-map dependency (rust-lang#1120)
The `vector-map` crate indirectly depends on a vulnerable version of rand_core. This crate hasn't been released for the past 2 years, and there hasn't been any activity in their github either. I'm replacing it by `linear-map` for now to fix the security warnings. Note that linear-map last release was 6 years ago, so we may have to remove it eventually. At least this crate only depends on serde.
1 parent 0c6e229 commit b0ba734

File tree

7 files changed

+89
-179
lines changed

7 files changed

+89
-179
lines changed

‎Cargo.lock‎

Lines changed: 13 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ version = "0.7.6"
1818
source = "registry+https://github.com/rust-lang/crates.io-index"
1919
checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
2020
dependencies = [
21-
"getrandom 0.2.6",
21+
"getrandom",
2222
"once_cell",
2323
"version_check",
2424
]
@@ -170,29 +170,18 @@ dependencies = [
170170
"winapi",
171171
]
172172

173-
[[package]]
174-
name = "contracts"
175-
version = "0.4.0"
176-
source = "registry+https://github.com/rust-lang/crates.io-index"
177-
checksum = "c9424f2ca1e42776615720e5746eed6efa19866fdbaac2923ab51c294ac4d1f2"
178-
dependencies = [
179-
"proc-macro2",
180-
"quote",
181-
"syn",
182-
]
183-
184173
[[package]]
185174
name = "cprover_bindings"
186175
version = "0.0.0"
187176
dependencies = [
188177
"lazy_static",
178+
"linear-map",
189179
"num",
190180
"num-traits",
191181
"serde",
192182
"serde_test",
193183
"string-interner",
194184
"tracing",
195-
"vector-map",
196185
]
197186

198187
[[package]]
@@ -280,17 +269,6 @@ dependencies = [
280269
"unicode-width",
281270
]
282271

283-
[[package]]
284-
name = "getrandom"
285-
version = "0.1.16"
286-
source = "registry+https://github.com/rust-lang/crates.io-index"
287-
checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
288-
dependencies = [
289-
"cfg-if",
290-
"libc",
291-
"wasi 0.9.0+wasi-snapshot-preview1",
292-
]
293-
294272
[[package]]
295273
name = "getrandom"
296274
version = "0.2.6"
@@ -299,7 +277,7 @@ checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
299277
dependencies = [
300278
"cfg-if",
301279
"libc",
302-
"wasi 0.10.2+wasi-snapshot-preview1",
280+
"wasi",
303281
]
304282

305283
[[package]]
@@ -450,6 +428,16 @@ version = "0.2.124"
450428
source = "registry+https://github.com/rust-lang/crates.io-index"
451429
checksum = "21a41fed9d98f27ab1c6d161da622a4fa35e8a54a8adc24bbf3ddd0ef70b0e50"
452430

431+
[[package]]
432+
name = "linear-map"
433+
version = "1.2.0"
434+
source = "registry+https://github.com/rust-lang/crates.io-index"
435+
checksum = "bfae20f6b19ad527b550c223fddc3077a547fc70cda94b9b566575423fd303ee"
436+
dependencies = [
437+
"serde",
438+
"serde_test",
439+
]
440+
453441
[[package]]
454442
name = "lock_api"
455443
version = "0.4.7"
@@ -678,12 +666,6 @@ version = "0.2.8"
678666
source = "registry+https://github.com/rust-lang/crates.io-index"
679667
checksum = "e280fbe77cc62c91527259e9442153f4688736748d24660126286329742b4c6c"
680668

681-
[[package]]
682-
name = "ppv-lite86"
683-
version = "0.2.16"
684-
source = "registry+https://github.com/rust-lang/crates.io-index"
685-
checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
686-
687669
[[package]]
688670
name = "proc-macro-error"
689671
version = "1.0.4"
@@ -737,47 +719,6 @@ dependencies = [
737719
"proc-macro2",
738720
]
739721

740-
[[package]]
741-
name = "rand"
742-
version = "0.7.3"
743-
source = "registry+https://github.com/rust-lang/crates.io-index"
744-
checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
745-
dependencies = [
746-
"getrandom 0.1.16",
747-
"libc",
748-
"rand_chacha",
749-
"rand_core",
750-
"rand_hc",
751-
]
752-
753-
[[package]]
754-
name = "rand_chacha"
755-
version = "0.2.2"
756-
source = "registry+https://github.com/rust-lang/crates.io-index"
757-
checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
758-
dependencies = [
759-
"ppv-lite86",
760-
"rand_core",
761-
]
762-
763-
[[package]]
764-
name = "rand_core"
765-
version = "0.5.1"
766-
source = "registry+https://github.com/rust-lang/crates.io-index"
767-
checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
768-
dependencies = [
769-
"getrandom 0.1.16",
770-
]
771-
772-
[[package]]
773-
name = "rand_hc"
774-
version = "0.2.0"
775-
source = "registry+https://github.com/rust-lang/crates.io-index"
776-
checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
777-
dependencies = [
778-
"rand_core",
779-
]
780-
781722
[[package]]
782723
name = "rayon"
783724
version = "1.5.2"
@@ -1181,16 +1122,6 @@ version = "0.8.2"
11811122
source = "registry+https://github.com/rust-lang/crates.io-index"
11821123
checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
11831124

1184-
[[package]]
1185-
name = "vector-map"
1186-
version = "1.0.1"
1187-
source = "registry+https://github.com/rust-lang/crates.io-index"
1188-
checksum = "550f72ae94a45c0e2139188709e6c4179f0b5ff9bdaa435239ad19048b0cd68c"
1189-
dependencies = [
1190-
"contracts",
1191-
"rand",
1192-
]
1193-
11941125
[[package]]
11951126
name = "version_check"
11961127
version = "0.9.4"
@@ -1208,12 +1139,6 @@ dependencies = [
12081139
"winapi-util",
12091140
]
12101141

1211-
[[package]]
1212-
name = "wasi"
1213-
version = "0.9.0+wasi-snapshot-preview1"
1214-
source = "registry+https://github.com/rust-lang/crates.io-index"
1215-
checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
1216-
12171142
[[package]]
12181143
name = "wasi"
12191144
version = "0.10.2+wasi-snapshot-preview1"

‎cprover_bindings/Cargo.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
name = "cprover_bindings"
66
version = "0.0.0"
77
edition = "2018"
8+
license = "MIT OR Apache-2.0"
89

910
[lib]
1011
test = true
@@ -17,7 +18,7 @@ num-traits = "0.2"
1718
serde = {version = "1", features = ["derive"]}
1819
string-interner = "0.14.0"
1920
tracing = "0.1"
20-
vector-map = "1.0.1"
21+
linear-map = {version = "1.2", features = ["serde_impl"]}
2122

2223
[dev-dependencies]
2324
serde_test = "1"

‎cprover_bindings/src/irep/irep.rs‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ use super::super::goto_program::{Location, Type};
66
use super::super::MachineModel;
77
use super::{IrepId, ToIrep};
88
use crate::cbmc_string::InternedString;
9+
use linear_map::LinearMap;
910
use num::BigInt;
1011
use std::fmt::Debug;
11-
use vector_map::VecMap;
1212

1313
/// The CBMC serialization format for goto-programs.
1414
/// CBMC implementation code is at:
@@ -17,7 +17,7 @@ use vector_map::VecMap;
1717
pub struct Irep {
1818
pub id: IrepId,
1919
pub sub: Vec<Irep>,
20-
pub named_sub: VecMap<IrepId, Irep>,
20+
pub named_sub: LinearMap<IrepId, Irep>,
2121
}
2222

2323
/// Getters
@@ -102,7 +102,7 @@ impl Irep {
102102
}
103103

104104
pub fn just_id(id: IrepId) -> Irep {
105-
Irep { id: id, sub: Vec::new(), named_sub: VecMap::new() }
105+
Irep { id: id, sub: Vec::new(), named_sub: LinearMap::new() }
106106
}
107107

108108
pub fn just_int_id<T>(i: T) -> Irep
@@ -111,7 +111,7 @@ impl Irep {
111111
{
112112
Irep::just_id(IrepId::from_int(i))
113113
}
114-
pub fn just_named_sub(named_sub: VecMap<IrepId, Irep>) -> Irep {
114+
pub fn just_named_sub(named_sub: LinearMap<IrepId, Irep>) -> Irep {
115115
Irep { id: IrepId::EmptyString, sub: vec![], named_sub: named_sub }
116116
}
117117

@@ -120,7 +120,7 @@ impl Irep {
120120
}
121121

122122
pub fn just_sub(sub: Vec<Irep>) -> Irep {
123-
Irep { id: IrepId::EmptyString, sub: sub, named_sub: VecMap::new() }
123+
Irep { id: IrepId::EmptyString, sub: sub, named_sub: LinearMap::new() }
124124
}
125125

126126
pub fn nil() -> Irep {

‎cprover_bindings/src/irep/serialize.rs‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,6 @@ use crate::irep::{Irep, IrepId, Symbol, SymbolTable};
55
use crate::InternedString;
66
use serde::ser::{SerializeMap, Serializer};
77
use serde::Serialize;
8-
use vector_map::VecMap;
9-
10-
// Wrapper type to allow impl of trait (otherwise impossible when both trait and type are external).
11-
struct MapWrapper<'a, K, V>(&'a VecMap<K, V>);
12-
13-
impl<K: serde::Serialize, V: serde::Serialize> Serialize for MapWrapper<'_, K, V> {
14-
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
15-
where
16-
S: Serializer,
17-
{
18-
let mut obj = serializer.serialize_map(None)?;
19-
for (k, v) in self.0 {
20-
obj.serialize_entry(k, v)?;
21-
}
22-
obj.end()
23-
}
24-
}
258

269
impl Serialize for Irep {
2710
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
@@ -34,7 +17,7 @@ impl Serialize for Irep {
3417
obj.serialize_entry("sub", &self.sub)?;
3518
}
3619
if !self.named_sub.is_empty() {
37-
obj.serialize_entry("namedSub", &MapWrapper(&self.named_sub))?;
20+
obj.serialize_entry("namedSub", &self.named_sub)?;
3821
}
3922
obj.end()
4023
}

0 commit comments

Comments
 (0)