Add advisory for bitvec-nom2: BSlice::offset can trigger UB via unsound offset

[DiuDiu777]

Affected crate(s)

• bitvec-nom2 (1,011,172 recent downloads per crates.io; 10,569,329 total downloads)

Links to upstream issue(s) or PR(s)

• Unsound Offset implementation allows cross-allocation pointer arithmetic in BSlice rust-bakery/nom-bitvec#5

The issue was publicly reported upstream on 2026-03-09 and remains open with no maintainer response as of 2026-05-27.

Severity

Informational soundness issue. Safe Rust code can trigger undefined behavior by calling BSlice::offset on two BSlice values backed by different allocations.

The affected implementation calls offset_from on the two underlying bit pointers. This is only valid when both pointers are derived from the same allocation. Miri reports ptr_offset_from being called on pointers from different allocations. No unsafe code is required from the caller.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

The issue has been public for more than two months without upstream response. I am filing this advisory under RustSec's documented allowance for advisories after public disclosure with no upstream response.

[djc]

@Geal ping?

[Geal]

Looking into it tomorrow, thanks for the ping