Skip to content

Function result mutation bug in Brillig

Moderate
Savio-Sou published GHSA-wvh3-mhm3-7wwv May 19, 2026

Package

No package listed

Affected versions

01fdf8

Patched versions

1.0.0-beta.21

Description

The following code:

#[inline_never]                                                                                                                                                                            
unconstrained fn g() -> [bool; 1] {                       
    [true]                                                                                                                                                                                 
}                                                         

unconstrained fn f() -> [bool; 1] {
    let mut b = g();
    let mut i: u32 = 0;
    loop {                                                                                                                                                                                 
        if (i == 1) { break }
        i += 1;                                                                                                                                                                            
        b[0] = false;                                     
    };
    g()
}

unconstrained fn main() -> pub [bool; 1] {                                                                                                                                                 
    f()
}  

returns [false] instead of [true] as evidently supposed to (f() -> g() -> [true]). Seemingly might be an unfixed variation of GHSA-qqxj-59g5-7jcv, with function calls taking place of the literals.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs