Denial of service with debug build of http-codec

[niklasf]

This is mostly a case of

When in doubt, please open a PR.

It's a minor issue, because only debug builds and builds with -C overflow-checks=on are affected. One reason to file an advisory would be that this is unlikely to get fixed: I contacted the author and he says he is no longer maintaining the crate.

[tarcieri]

Hi there, sorry for the delay reviewing this.

It sounds like a panic for debug builds and integer overflow for non-debug builds. Either way that does not seem good. I think this is worth including.

[Shnatsel]

As per the criteria discussed here I'd rather not include otherwise harmless overflows and debug-mode panics, at least until a severity system is in place.

[tarcieri]

Alright, I can agree with that