GHSA-h588-76vg-prgj: `DecimalArray` does not perform bound checks on accessing values and offsets

June 16, 2022 (updated February 9, 2023)

DecimalArray performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.

References

github.com/advisories/GHSA-h588-76vg-prgj
github.com/apache/arrow-rs
github.com/apache/arrow-rs/issues/775
rustsec.org/advisories/RUSTSEC-2021-0117.html

Code Behaviors & Features

Detect and mitigate GHSA-h588-76vg-prgj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →