Skip to content

Incorrect conditional mutable reference assignment in Brillig

Moderate
Savio-Sou published GHSA-v2q4-prvf-7h73 Jun 9, 2026

Package

No package listed

Affected versions

6dd239

Patched versions

1.0.0-beta.22

Description

The following code:

#[inline_never]
unconstrained fn returns_true() -> bool {
    true
}

unconstrained fn f(mut a: bool, mut b: bool) -> bool {
    let r: &mut bool = if returns_true() { &mut a } else { &mut b };
    a = true;
    *r
}

unconstrained fn main() -> pub bool {
    f(false, false)
}

returns false. Under comptime, it's true (which seemingly should be correct). The uninlined returns_true() function is required for this behavior.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs