Add advisory for invalid layout assumptions in quinn (#804)

crates/quinn/RUSTSEC-0000-0000.md

@@ -0,0 +1,23 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "quinn"
+aliases = []
+date = "2021-03-04"
+url = "https://github.com/quinn-rs/quinn/issues/968"
+keywords = ["memory", "layout", "cast"]
+informational = "unsound"
+
+[versions]
+patched = ["^0.5.4", "^0.6.2", ">= 0.7.0"]
+```
+
+# `quinn` invalidly assumes the memory layout of std::net::SocketAddr
+
+The [`quinn`](https://crates.io/crates/quinn) crate has assumed `std::net::SocketAddrV4`
+and `std::net::SocketAddrV6` have the same memory layout as the system C representation
+`sockaddr`. It has simply casted the pointers to convert the socket addresses to the
+system representation. The standard library does not say anything about the memory
+layout, and this will cause invalid memory access if the standard library
+changes the implementation. No warnings or errors will be emitted once the
+change happens.