Memory corruption via panic-triggered double drop

Double free in the Rust slice-deque crate 0.3.0 and earlier allows attackers to corrupt memory through a panicking drain predicate. SliceDeque::drain_filter advances its iterator index before calling self.pred, so panic unwinding drops the last element twice. Reachability requires a consuming application to invoke drain_filter with an attacker-influenced predicate that panics; the demonstrated consequence is memory corruption and process termination.