Description
This issue was previously reported privately and is now being disclosed following coordination with maintainers.
ArrayData validation performs length-based calculations without overflow checking.
In certain cases, overflow may bypass validation checks and allow construction of invalid internal states.
This can result in a potential out-of-bounds read via safe Rust APIs.
Fix
See PR #9816
Reported by Sungjin Kim (@ksj1230)
Description
This issue was previously reported privately and is now being disclosed following coordination with maintainers.
ArrayData validation performs length-based calculations without overflow checking.
In certain cases, overflow may bypass validation checks and allow construction of invalid internal states.
This can result in a potential out-of-bounds read via safe Rust APIs.
Fix
See PR #9816
Reported by Sungjin Kim (@ksj1230)