DecompressScanlines::read_scanlines is unsound

[197g]

https://docs.rs/mozjpeg/0.8.17/mozjpeg/decompress/struct.DecompressStarted.html#method.read_scanlines

This method will write arbitrary, user controlled bytes into a slice of T: Copy. This can lead to invalid instances of T to be returned. Same reason as rgb but without the 'static bound so a little different. This can be used to decode scanlines into a Vec<&'static u8> or something along those lines and dereference some arbitrary memory with a crafted input file. No writable variant this time.

[kornelski]

Thanks. It's going to be plain crate again. I'm waiting for randomites/plain#6 because I've noticed that crate has a big omission in impls.

[kornelski]

Fixed in 0.8.19