Add advisory for sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right

[tooson9010-spec]

Affected crate(s)

• sized-chunks 0.7.0 (6,946,615 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

The repo is archived with issues/PRs disabled. I emailed the maintainer on 2026-04-22 with no response. Unmaintained status is tracked in #3058 / #3093.

Severity

Panic-safety unsoundness in Chunk, RingBuffer, and InlineArray (clear, drop_left, drop_right, InlineArray::clear). Elements are dropped before the length/boundary metadata is updated, so a panicking element Drop leaves stale metadata and the container's own Drop re-drops already-freed elements — use-after-free / double-free reachable from safe Rust, confirmed under AddressSanitizer. Distinct from RUSTSEC-2020-0041 (Chunk::clone / insert_from, fixed in 0.6.3); still affected in 0.7.0.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (repo archived, issues disabled, emailed maintainer 2026-04-22 with no response — unreachable-author exception)

[djc]

See

• Add advisories for Bodil's crates #3093

[tooson9010-spec]

Thanks for the reply. I saw #3093 adds the unmaintained advisory for sized-chunks.

This PR (#3111) is the companion informational = "unsound" advisory you mentioned
wanting in #3058, so I think the two are complementary rather than overlapping:

• Add advisories for Bodil's crates #3093: sized-chunks unmaintained
• Add advisory for sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right #3111 (this): sized-chunks unsound — panic-safety double-free / UAF in clear,
  drop_left, drop_right on Chunk, RingBuffer, and InlineArray.

Happy to adjust this to fit alongside #3093 however works best.
Please let me know how you'd like to proceed.

[tooson9010-spec]

While doing research on panic-safety unsoundness, I found the same issue in
sp-sized-chunks (https://crates.io/crates/sp-sized-chunks), a fork of sized-chunks
by yatima-inc. It has the same bugs in Chunk::{clear, drop_left, drop_right} and
InlineArray::clear (confirmed under ASan); the repo is archived and it's still on
0.1.0 with no fix.

Since it's a separate crate under a different owner, would a separate unsound
advisory be the way to go? Thanks!

[djc]

Yes, a separate advisory would be the way to go. Use the pull request template both for this advisory and for the other one.

[tooson9010-spec]

Thanks. I've updated the PR description to follow the template. The separate advisory for sp-sized-chunks is filed in #3136.