Add advisory for sp-sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right

[tooson9010-spec]

Affected crate(s)

• sp-sized-chunks 0.1.0 (197 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

The repo is archived and the crate is still on 0.1.0 with no fix, so upstream reporting isn't possible. sp-sized-chunks is a fork of sized-chunks (companion advisory in #3111).

Severity

Panic-safety unsoundness in Chunk and InlineArray (clear, drop_left, drop_right, InlineArray::clear). Elements are dropped before the length/boundary metadata is updated, so a panicking element Drop leaves stale metadata and the container's own Drop re-drops already-freed elements — use-after-free / double-free reachable from safe Rust, confirmed under AddressSanitizer.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (repo archived, no fix on 0.1.0 — unreachable-author exception; fork of sized-chunks, discussed in Add advisory for sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right #3111)

[djc]

Suggest adding a separate informational = "unmaintained" advisory as well.

[tooson9010-spec]

Filed the unmaintained advisory as a separate PR: #3143