Memory exposure via uninitialized parser buffer

Use of uninitialized memory in tectonic_xdv before 0.1.12 allows attackers controlling a Read implementation to expose process memory. XdvParser::::process allocates a 4,096-byte vector, unsafely sets its length without initializing the backing storage, and passes that buffer to the supplied Read implementation. Exploitation requires application code to invoke the parser with an attacker-controlled Read implementation; the resulting undefined behavior can disclose prior memory contents or crash the process.