Merge pull request #812 from MoAlyousef/master

add known issues with fltk

crates/fltk/RUSTSEC-0000-0000.md

@@ -0,0 +1,24 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "fltk"
+date = "2021-03-06"
+keywords = ["undefined_behavior"]
+url = "https://github.com/MoAlyousef/fltk-rs/issues/519"
+
+[affected.functions]
+"fltk::prelude::WidgetExt::set_label_type" = ["< 0.15.2"]
+"fltk::prelude::WindowExt::set_icon" = ["< 0.14.12"]
+"fltk::image::Pixmap::new" = ["< 0.15.2, >= 0.14.12"]
+
+[versions]
+patched = [">= 0.15.3"]
+```
+
+# Multiple memory safety issues
+
+Affected versions contain multiple memory safety issues, such as:
+
+ - Setting a multi label type where an image doesn't exist would lead to a NULL pointer dereference.
+ - Setting a window icon using a non-raster image (which FLTK rasterizes lazily) would lead to a NULL dereference.
+ - Pixmap constructor would not check for correct pixmaps which could lead to out-of bound reads.