(arrow-rs) branch 57_maintenance updated: [57_maintenance] Prevent repeat slice length overflow (#9819) (#9920)

[alamb]

This is an automated email from the ASF dual-hosted git repository.

alamb pushed a commit to branch 57_maintenance
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git


The following commit(s) were added to refs/heads/57_maintenance by this push:
     new 090e8cbbf2 [57_maintenance] Prevent repeat slice length overflow 
(#9819) (#9920)
090e8cbbf2 is described below

commit 090e8cbbf2b85e4d37a62616316d35b1c2686f0f
Author: Andrew Lamb <and...@nerdnetworks.org>
AuthorDate: Wed May 6 11:05:23 2026 -0400

    [57_maintenance] Prevent repeat slice length overflow (#9819) (#9920)
    
    - Part of https://github.com/apache/arrow-rs/issues/9858
    - Fixes https://github.com/apache/arrow-rs/issues/9904 in 57.x releases
    
    This PR:
    - Backports https://github.com/apache/arrow-rs/pull/9819 from @alamb to
    the `57_maintenance` line
---
 arrow-buffer/src/buffer/mutable.rs | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/arrow-buffer/src/buffer/mutable.rs 
b/arrow-buffer/src/buffer/mutable.rs
index 926a874219..b00168783d 100644
--- a/arrow-buffer/src/buffer/mutable.rs
+++ b/arrow-buffer/src/buffer/mutable.rs
@@ -319,9 +319,15 @@ impl MutableBuffer {
         }
 
         let bytes_to_repeat = size_of_val(slice_to_repeat);
+        let repeated_bytes = repeat_count
+            .checked_mul(bytes_to_repeat)
+            .expect("repeated slice byte length overflow");
+        self.len
+            .checked_add(repeated_bytes)
+            .expect("mutable buffer length overflow");
 
         // Ensure capacity
-        self.reserve(repeat_count * bytes_to_repeat);
+        self.reserve(repeated_bytes);
 
         // Save the length before we do all the copies to know where to start 
from
         let length_before = self.len;
@@ -1429,6 +1435,21 @@ mod tests {
         test_repeat_count(0, &[1i32, 2, 3]);
     }
 
+    #[test]
+    #[should_panic(expected = "repeated slice byte length overflow")]
+    fn test_repeat_slice_count_multiply_overflow() {
+        let mut buffer = MutableBuffer::new(0);
+        buffer.repeat_slice_n_times(&[0_u64], usize::MAX / 
mem::size_of::<u64>() + 1);
+    }
+
+    #[test]
+    #[should_panic(expected = "mutable buffer length overflow")]
+    fn test_repeat_slice_count_len_overflow() {
+        let mut buffer = MutableBuffer::new(0);
+        buffer.push(0_u8);
+        buffer.repeat_slice_n_times(&[0_u8], usize::MAX);
+    }
+
     #[test]
     fn test_small_repeats_counts() {
         // test any special implementation for small repeat counts