The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
{ "urgency": "not yet assigned" }