Add advisory for hugepage-rs dealloc unsoundness

[sisy2020]

Affected crate(s)

• hugepage-rs (5,405 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Upstream issue: Possible unsound public API cppcoffee/hugepage-rs#5
• Fix PR: Fix/robustness cppcoffee/hugepage-rs#6
• Fix commit: cppcoffee/hugepage-rs@2b30bdf

Severity

Soundness issue in a safe public API. hugepage_rs::dealloc accepted an arbitrary raw pointer and Layout, then forwarded them to GlobalAlloc::dealloc, whose safety contract requires the pointer and layout to match an allocation from the same allocator.

Safe callers could therefore trigger undefined behavior without using unsafe.

The issue was fixed upstream by marking dealloc as unsafe, and the fix has been published in 0.1.1.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Waiting for maintainer response. Don't forget to include the crates.io recent download count in your PR descriptions.