When trying to run my program with miri, it reports UB, however with the note that "the Stacked Borrows rules it violated are still experimental". This minimal example UBs according to miri. I don't know how to make it more minimal unfortunately without investing too much time into it. I'm not using circular directly, it's a transitive dependency through rc-zip.

use rc_zip::prelude::*;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let f = &include_bytes!("../tests/data/Test.docx")[..];
    let a = f.read_zip_with_size(f.len() as u64).unwrap();
    let entry = a.by_name("word/document.xml").unwrap();
    let mut doc = xml::EventReader::new(entry.reader());
    let _ = doc.next();
    Ok(())
}

Cargo.toml:

[package]
name = "ziptest"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
rc-zip = "2.0.1"
xml-rs = "0.8.16"

Is this a valid concern or a false positive?

Test.docx (but any Word document should do I guess)

Output:

Full output: output.txt