Add advisory for UB in crossbeam-channel 0.4.3

[taiki-e]

The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.

Refs: crossbeam-rs/crossbeam#533, crossbeam-rs/crossbeam#539 (Both issues are mainly saying about crossbeam-queue, but crossbeam-queue including this UB, has not been released and only crossbeam-channel is affected.)

[Shnatsel]

Thanks for the report!

Is this purely theoretical at this point, or has deallocation of the incorrect size has actually been observed in practice? If it's the latter, I'd drop informational = "unsound".

Last time I checked from_iter never over-allocated in practice, but that was over a year ago and there have been some optimizations for small vector sizes, like the first allocation was always having size 4.

[taiki-e]

Is this purely theoretical at this point, or has deallocation of the incorrect size has actually been observed in practice? If it's the latter, I'd drop informational = "unsound".

It has actually been observed in practice (https://twitter.com/khuey_/status/1311641831201857537, nervosnetwork/ckb#2244), so I'll drop informational field.

Last time I checked from_iter never over-allocated in practice, but that was over a year ago and there have been some optimizations for small vector sizes, like the first allocation was always having size 4.

If the number of elements is small, it seems that 0-7 extra capacity is allocated depending on the size of the elements.
(playground)

[Shnatsel]

Merging. Thanks!