When activating the non-default feature serialize, most structs implement
serde::Deserialize without sufficient validation. This allows breaking
invariants in safe code, leading to:
- Undefined behavior in
as_string()methods (which use
std::str::from_utf8_unchecked()internally). - Panics due to failed assertions.
See https://github.com/gz/rust-cpuid/issues/43.