io: Enable features in internals crate
What the developer wrote
Authored by Tobin C. Harding
io: Enable features in internals crate
In `io` we use a macro from `internals` that has feature gated code
dependent on "alloc" but currently we are not enabling "alloc". This
is a bug -
Repeat after me: calling macros across crate boundries is an incessant
source of bugs.
What changed, and why it matters
This commit fixes a build-configuration bug in the `io` crate of rust-bitcoin. The `io` crate uses a macro from another internal crate (`internals`) whose generated code depends on an `alloc` feature, but `io` was not forwarding the `alloc` feature to `internals`. This could cause compilation failures or missing functionality when `io` is used without the default `std` feature but with `alloc`. It is a correctness and reliability fix rather than a direct exploitable vulnerability.
Treat as a routine bugfix. Users building `io` in no-std environments with `alloc` should upgrade. No immediate security response is indicated unless downstream analysis shows the missing feature caused a concrete exploitable failure.
Security signals we found
Feature-gated macro usage across crate boundaries
Potential compile-time failure or disabled code path in no-std/alloc builds
No direct memory-safety or cryptographic weakness visible in diff
Evidence from the diff
The io/Cargo.toml now forwards std and alloc features to the bitcoin-internals dependency. Previously, io used a macro from internals that emits feature-gated code requiring alloc, but internals/alloc was not enabled when io/alloc was active. This mismatch could lead to compile errors or silently disabled code paths in no-std/alloc-only builds. The patch is minimal and partial in the sense that it only addresses the known macro-related feature forwarding issue.
Changed components
rust-bitcoin/io craterust-bitcoin/internals crate (bitcoin-internals)Feature configuration for std/alloc buildsInspect captured patch +2 / −2
diff --git a/io/Cargo.toml b/io/Cargo.toml
index 07b38baa..8d15cec4 100644
--- a/io/Cargo.toml
+++ b/io/Cargo.toml
@@ -15,8 +15,8 @@ exclude = ["tests", "contrib"]
[features]
default = ["std"]
-std = ["alloc", "hashes?/std"]
-alloc = ["hashes?/alloc"]
+std = ["alloc", "hashes?/std", "internals/std"]
+alloc = ["hashes?/alloc", "internals/alloc"]
[dependencies]
internals = { package = "bitcoin-internals", path = "../internals" }
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.