[Security] Bump smallvec from 0.6.9 to 0.6.14

[dependabot-preview]

⚠️ Dependabot Preview has been deactivated ⚠️

This pull request was created by Dependabot Preview, and you've upgraded to Dependabot. This means it won't respond to dependabot commands nor will it be automatically closed if a new version is found.

If you close this pull request, Dependabot will re-create it the next time it checks for updates and everything will work as expected.

---

Bumps smallvec from 0.6.9 to 0.6.14. This update includes security fixes.

Vulnerabilities fixed

Sourced from The RustSec Advisory Database.

Memory corruption in SmallVec::grow() Attempting to call grow on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures.

An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.

Credits to @ehuss for discovering, reporting and fixing the bug.

Patched versions: >= 0.6.10 Unaffected versions: < 0.6.3

Sourced from The RustSec Advisory Database.

Double-free and use-after-free in SmallVec::grow() Attempting to call grow on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents.

An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.

Credits to @ehuss for discovering, reporting and fixing the bug.

Patched versions: >= 0.6.10 Unaffected versions: < 0.6.5

Release notes

Sourced from smallvec's releases.

v0.6.14

• Fix a possible buffer overflow in insert_many (#252, #254).

v0.6.13

• Use the maybe-unit crate in place of soon-to-be-deprecated std::mem::uninitialized (#180). When built with Rust 1.36 or later, this fixes a source of undefined behavior. It also fixes deprecation warnings in Rust 1.39 and later, and test failures when run in MIRI. In Rust 1.35 and earlier it provides some safety improvements but does not completely eliminate undefined behavior. (However, we are not aware of any cases where the undefined behavior causes bugs in practice in those toolchains.)

v0.6.12

• Move code using default fn into its own module (#161).

v0.6.11

• The unstable alloc feature is no longer needed. This crate can now build with the std feature disabled on stable Rust 1.36 or later (#159).

v0.6.10

• Fix a bug in extend with certain iterators (#150).
• Fix soundness bugs in the grow method (#151, #152).
• Fix typo in docs (#144).

Commits

• 5757ac5 Fix potential buffer overflow in insert_many
• 7852204 Merge pull request #180 from mbrubeck/maybe_uninit
• 58d5416 Add a test for #139.
• 26ea2ca Run miri in CI
• e64afc8 Use MaybeUninit for storage of inline items.
• 87f156b Version 0.6.12
• e60df76 Version 0.6.11
• 3ee6d1e Auto merge of #161 - Centril:master, r=emilio
• 92122e2 Move use of 'default fn' to its own module.
• c83bb71 Auto merge of #159 - CryZe:no-std, r=emilio
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[tas50]

@dependabot rebase

[dependabot-preview]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[tas50]

@dependabot recreate