Add advisory for hecs: double free when a component's Drop panics

[tooson9010-spec]

Affected crate(s)

• hecs (150,270 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

Fixed in Ralith/hecs#471 and Ralith/hecs#474, released in 0.11.2.

Severity

Panic-safety unsoundness. Several hecs operations run component destructors before committing the bookkeeping that records which slots hold live components. A panicking component Drop skips that commit, so already-dropped slots are still treated as live and a later Drop for Archetype or a subsequent operation destroys them again — a double free (CWE-415) reachable from safe Rust, confirmed under AddressSanitizer on 0.11.1. Reached from World::clear, World::despawn, World::spawn_at, World::spawn_column_batch_at and CommandBuffer::run_on. Fixed in 0.11.2.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Given this comment from the maintainer:

Sure, if you like. It's difficult to imagine a realistic scenario in which this could be deliberately triggered and present an actual security hazard, so the severity should be recorded accordingly, but it's certainly not technically impossible.

I don't think having an advisory makes sense.