René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"RUSTSEC-2026-0190: Unsoundness in `Error::downcast_mut()`","articleBody":"\n\u003e Unsoundness in `Error::downcast_mut()`\n\n| Details             |                                                |\n| ------------------- | ---------------------------------------------- |\n| Status              | unsound                |\n| Package             | `anyhow`                      |\n| Version             | `1.0.102`                   |\n| URL                 | [https://github.com/dtolnay/anyhow/issues/451](https://github.com/dtolnay/anyhow/issues/451) |\n| Date                | 2026-06-25                         |\n\nAffected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via `Error::context` and then later calls `Error::downcast_mut` on the returned `Error`.\n\nThe flaw was corrected in commit `6e8c000` by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.\n\n## Example\n\n```rust\nuse anyhow::Error;\nuse std::fmt;\n\n#[derive(Debug)]\nstruct ErrorContext(\u0026amp;\u0026#39;static str);\n\nimpl fmt::Display for ErrorContext {\n    fn fmt(\u0026amp;self, f: \u0026amp;mut fmt::Formatter\u0026lt;\u0026#39;_\u0026gt;) -\u0026gt; fmt::Result {\n        fmt::Display::fmt(\u0026amp;self.0, f)\n    }\n}\n\nfn main() {\n    let mut error = Error::msg(\u0026quot;inner error\u0026quot;).context(ErrorContext(\u0026quot;old context\u0026quot;));\n    let context: \u0026amp;mut ErrorContext = error.downcast_mut().unwrap();\n    context.0 = \u0026quot;new context\u0026quot;;\n    println!(\u0026quot;{:?}\u0026quot;, error);\n}\n```\n\n## Miri output\n\n```\nerror: Undefined Behavior: trying to retag from \u0026lt;1538\u0026gt; for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location\n   --\u0026gt; src/ptr.rs:170:18\n    |\n170 |         unsafe { \u0026amp;mut *self.ptr.as_ptr() }\n    |                  ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]\n    |\n    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental\n    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information\nhelp: \u0026lt;1538\u0026gt; was created by a SharedReadOnly retag at offsets [0x38..0x48]\n   --\u0026gt; src/ptr.rs:89:18\n    |\n 89 |             ptr: NonNull::from(ptr),\n    |                  ^^^^^^^^^^^^^^^^^^\n    = note: stack backtrace:\n            0: anyhow::ptr::Mut::\u0026lt;\u0026#39;_, ErrorContext\u0026gt;::deref_mut\n                at src/ptr.rs:170:18: 170:41\n            1: anyhow::error::\u0026lt;impl anyhow::Error\u0026gt;::downcast_mut::\u0026lt;ErrorContext\u0026gt;\n                at src/error.rs:560:18: 560:46\n            2: main\n                at examples/downcast_mut.rs:15:38: 15:58\n```\n\nSee [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0190.html) for additional details.\n","author":{"url":"https://github.com/github-actions[bot]","@type":"Person","name":"github-actions[bot]"},"datePublished":"2026-06-30T00:34:34.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/255/diffutils/issues/255"}