Add advisory for rtrb: panic-safety double-free in ReadChunk::commit

[tooson9010-spec]

Affected crate(s)

• rtrb (3,205,892 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

Reported in mgeier/rtrb#185. Fixed in mgeier/rtrb#186, released in 0.3.5 and 0.4.0.

Severity

Panic-safety unsoundness in ReadChunk::commit / commit_all: the committed elements are dropped before the consumer head is advanced, so a panicking element Drop leaves the head pointing at already-dropped slots. The RingBuffer destructor then drops them again — a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust, confirmed under AddressSanitizer. Fixed in 0.3.5 and 0.4.0.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (maintainer approved in the issue)