RUSTSEC-2026-0397: OutBuffer::around_pos exposes uninitialized memory #33

OutBuffer::around_pos exposes uninitialized memory

OutBuffer::around_pos accepted a position past the initialized length of a
Vec<u8>. The next streaming call then marked everything before the
position as initialized, so safe code could read stale heap memory between
the vector's previous length and that position.

The flaw was corrected by zero-filling that gap.

See advisory page for additional details.