GitHub Advisoryadvisory · crates.io

GHSA-h588-76vg-prgj `DecimalArray` does not perform bound checks on accessing values and offsets

HIGH Published 2022-06-16 Modified 2023-02-09 Official page ↗
Ecosystem
crates.io
Packages
arrow
Severity
High
Reviewed
2022-06-16

Affected packages

• crates.io arrow: < 6.4.0 → fixed in 6.4.0

Description

`DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.

References