Add unmaintained advisory for safemem

[oherrala]

safemem is crate by @abonander who has archived bunch of his Rust crates in GitHub.

See communication attempts on other crates:

• buf_redux might be unmaintained #1602
• multipart Status #1438

[pinkforest]

Please can we use formatting / fill the necessary detail accordingly per this example:
https://github.com/rustsec/advisory-db/blob/main/crates/buf_redux/RUSTSEC-2023-0028.md

[pinkforest]

@dignifiedquire I understand both buffer-redux and buf-redux relies on this

I wonder if buffer-redux could possibly adopt a fork of this as well .. or drop / switch it by any chance ?

This is because if we would merge this anyone using buffer-redux would get a warning via that about safemem and would like to clarify this first to reduce impact / provide more actionable advice if possible / feasible.

The crate has had some minimal attention like 2019 with basic miri but it's safety related documentation is kinda thin and it uses panics as it's error handling - not drawing any concrete conclusions either way but anyways worth asking 🤷‍♀️

[dignifiedquire]

I wonder if buffer-redux could possibly adopt a fork of this as well .. or drop / switch it by any chance ?

Probably makes sense to either inline or replace.

[oherrala]

The safemem GitHub repository has been archived: https://github.com/abonander/safemem

This repository has been archived by the owner on Feb 14, 2023. It is now read-only.

[Shnatsel]

Thanks for the heads-up!

I've changed the advisory to only include very obviously correct and uncontroversial statements. I'm going to go ahead and merge this now that we have a clear signal from the maintainer in the form of an archived repo.

[Skgland]

The safemem crate only has three functions, two of which have standard library alternatives by now and one can be workedaround relatively easily. Would it make sense to include some migration instructions in the form of:

Migration

• safemem::copy_over(slice, src_idx, dest_idx, len); can be replaced with slice.copy_within(src_idx..src_idx+len, dest_idx); as of rust 1.37.0.
• safemem::write_bytes(slice, byte); can be replaced with slice.fill(byte); as of rust 1.50.0
• safemem::prepend(slice, vec); can be replaced with

  let old_len = vec.len();
  vec.extend_from_slice(slice);
  vec.rotate_left(old_len);

  as of rust 1.26.0

[amousset]

Sure 👍, feel free to open a PR.