Skip to content

[arrow-array] Integer overflow in FixedSizeBinaryArray::value leads to undefined behavior #9898

@ksj1230

Description

@ksj1230

Description

This issue was previously reported privately and is now being disclosed following coordination with maintainers.

FixedSizeBinaryArray::value() performs offset calculations using truncating integer casts, which can lead to overflow and incorrect pointer offsets.

This can result in a potential out-of-bounds read via safe Rust APIs.

Fix

See PR #9850

Reported by Sungjin Kim (@ksj1230)

Metadata

Metadata

Assignees

No one assigned

    Labels

    arrowChanges to the arrow crate

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions