Add advisory for sfbinpack: OOB read via BitReader

[yaokunzhang]

Affected crate(s)

• sfbinpack (4329 recent downloads on crates.io)

Links to upstream issue(s) or PR(s)

• Potential Unsoundness: out-of-bound Disservin/binpack-rust#17

Severity

Out-of-bounds read. CompressedTrainingDataEntryReader constructs a BitReader from a raw pointer without tracking length. Crafted input triggers OOB reads. Triggerable from safe code (CompressedTrainingDataEntryReader::new(), .next()).

Checklist

• Advisory filename starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

This appears to have been fixed in 0.6.2.