Add advisory for xjbutil ZeroVec unsoundness

[sisy2020]

Affected crate(s)

• xjbutil (401 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Upstream issue: Consider mark function as unsafe or add check chuigda/xjbutil#4
• Fix PR: Mark ZeroVec::get_unchecked methods as unsafe chuigda/xjbutil#5
• Fix commit: chuigda/xjbutil@68628f3

Severity

Soundness issue in a safe public API. ZeroVec::get_unchecked and ZeroVec::get_unchecked_mut accepted an arbitrary index and used it in unchecked pointer arithmetic. Safe callers could trigger out-of-bounds reads or writes without using unsafe.

The fix has been merged upstream, but no patched version has been published to crates.io yet.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Please use the pull request template.

[sisy2020]

Thanks, updated the PR body to use the template.

[djc]

[ ] Asked maintainer(s) if publishing an advisory is appropriate

No answer yet AFAICT.

[sisy2020]

Hi, just a gentle ping on this PR as it's been inactive for a while. Is there anything I can update or do to help move this forward? Thanks!

[djc]

(@sisy2020 please also add recent download counts from crates.io to the PR descriptions, as suggested by the template.)