Add advisory for stack_collections

[OverwrittenCode]

Affected crate(s)

• stack_collections (crates.io: https://crates.io/crates/stack_collections)

Links to upstream issue(s) or PR(s)

• Fix double free when retain unwinds OverwrittenCode/stack_collections#4

Severity

StackVec::retain committed its new length only after its internal loop
completed. If the retain predicate or a removed element's Drop panicked
before the loop finished, unwinding proceeded with the vector's length
still equal to the original length, leaving either a duplicated or an
already-destroyed element inside 0..len. StackVec's own Drop then
revisited that slot, causing a double-drop - and for any T owning a
heap allocation or other resource, a double-free.

Requires T: Drop with a predicate or destructor capable of panicking,
on builds with unwinding enabled (panic = "unwind"); not exploitable
under panic = "abort".

I am the maintainer of stack_collections; this advisory is self-filed
following the fix merged in the linked PR.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[LawnGnome]

Thanks!