Why does this Rust program leak memory?