Add advisory for bitm RankSimple unsoundness

[sisy2020]

Affected crate(s)

• bitm (129557 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Upstream issue: Posssible unsound public API beling/bsuccinct-rs#10
• Fix commit: beling/bsuccinct-rs@f281461

Severity

Soundness issue in a safe public API. In affected versions, safe code could violate RankSimple's internal invariants and cause try_rank to perform an out-of-bounds get_unchecked read, which is undefined behavior.

The issue has been fixed in 0.5.2 by making the RankSimple fields private.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate