Add unsound advisory for lockfree

[tooson9010-spec]

Affected crate(s)

• lockfree (601,950 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

https://gitlab.com/bzim/lockfree/-/issues/7

Severity

Two independent soundness problems, both reachable from safe Rust and confirmed with sanitizers. Map::into_iter drops the caller-supplied hasher before committing with mem::forget(self), so a panicking H::drop leaves the unwinding Map to drop it again — use-after-free / double-free under AddressSanitizer, with an empty map. SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into a live field, which Miri reports as undefined behavior with no panic or concurrency involved; the macro is instantiated five times. No fixed release.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (reported two weeks ago, no response; the crate has had no release since 2018 and an August 2024 unmaintained inquiry also went unanswered)