Skip to content

[arrow-row] Integer overflow in Rows::row index handling leads to undefined behavior #9901

@ksj1230

Description

@ksj1230

Description

This issue was previously reported privately and is now being disclosed following coordination with maintainers.

Rows::row() computes row + 1 without overflow checking. When the addition wraps, bounds checks may pass incorrectly, leading to invalid indexing.

This can result in a potential out-of-bounds read via safe Rust APIs.

Fix

See PR #9817

Reported by Sungjin Kim (@ksj1230)

Metadata

Metadata

Assignees

No one assigned

    Labels

    arrowChanges to the arrow crate

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions