Add advisory for sp-sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right

[tooson9010-spec]

Affected crate(s)

• sp-sized-chunks 0.1.0

Links to upstream issue(s) or PR(s)

The repo is archived and the crate is still on 0.1.0 with no fix, so upstream reporting isn't possible. sp-sized-chunks is a fork of sized-chunks (companion advisory in rustsec#3111).

Severity

Panic-safety unsoundness in Chunk and InlineArray (clear, drop_left, drop_right, InlineArray::clear). Elements are dropped before the length/boundary metadata is updated, so a panicking element Drop leaves stale metadata and the container's own Drop re-drops already-freed elements — use-after-free / double-free reachable from safe Rust, confirmed under AddressSanitizer.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (repo archived, no fix on 0.1.0 — unreachable-author exception; fork of sized-chunks, discussed in Add advisory for sized-chunks: panic-safety UAF/double-free in clear/drop_left/drop_right rustsec/advisory-db#3111)