RUSTSEC-2024-0400: ruzstd uninit and out-of-bounds memory reads

[github-actions]

ruzstd uninit and out-of-bounds memory reads

Details
Package	ruzstd
Version	0.7.2
URL	KillingSpark/zstd-rs#75
Date	2024-11-28
Patched versions	>=0.7.3
Unaffected versions	<0.7.0

Affected versions of ruzstd miscalculate the length of the allocated
and init section of its internal RingBuffer, leading to uninitialized
or out-of-bounds reads in copy_bytes_overshooting of up to 15 bytes.

This may result in up to 15 bytes of memory contents being written
into the decoded data when decompressing a crafted archive.
This may occur multiple times per archive.

See advisory page for additional details.

[tomaka]

Fixed in #2040