Add advisory for trk-io: OOB read in ArraySequence Index

[yaokunzhang]

Affected crate(s)

• trk-io (79 recent downloads on crates.io)

Links to upstream issue(s) or PR(s)

• Unsoundness: OOB imeka/trk-io#24

Severity

Out-of-bounds read. The Index implementation for ArraySequence uses get_unchecked without validating bounds. An empty sequence indexed at 0 triggers OOB. Triggerable from safe code.

Checklist

• Advisory filename starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

No clear approval from maintainers about publishing an advisory.