Add advisory for owned-alloc: panic-safety double-free in OwnedAlloc::drop_in_place

[tooson9010-spec]

Affected crate(s)

• owned-alloc (736,101 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

Reported in bzim/owned-alloc#1 (2026-09-08). Same maintainer and account as lockfree, where a public issue and a private email have both gone unanswered; no release since 2018.

Severity

Panic-safety unsoundness in OwnedAlloc::drop_in_place: the contained value is destroyed by hand, and the mem::forget(self) that commits the ownership transfer lives inside into_raw and so runs only afterwards. A panicking T::drop skips the commit, so the still-live OwnedAlloc unwinds and its destructor drops the same T a second time before deallocating — a double free (CWE-415). The destructor also reads the destroyed value through Layout::for_value on the way (CWE-416). Confirmed under AddressSanitizer (attempting double-free).

MaybeUninitAlloc::drop_in_place delegates to the same function, so both public entry points are affected. Storing a value whose Drop can panic and calling either is enough; no unsafe on the caller's side.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (reported upstream)