Add advisory for bytes-str: BytesString::split_off can break UTF-8 invariant

[yilin0518]

Affected crate(s)

• bytes-str (3,327,893 recent downloads on crates.io)

Links to upstream issue(s) or PR(s)

• Soundness issue: BytesString::split_off can break UTF-8 invariant and cause UB via safe APIs dudykr/ddbase#90

Severity

Soundness issue in safe code leading to undefined behavior (invalid &str constructed via split_off() + as_str()), with potential for memory corruption.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Pinged the maintainer on the upstream issue, let's see what they see -- feel free to ping me again in 4 weeks if there's been no response.

[djc]

@kdy1 so do you think this warrants an advisory being published?