jmestwa-coder opened a new pull request, #50036: URL: https://github.com/apache/arrow/pull/50036
WKBBuffer::ReadCoords computes the coordinate-sequence length as n_coords * sizeof(Coord) in size_t, where n_coords is a uint32 read straight from the WKB geometry bytes. On 32-bit targets such as wasm32 that product overflows, so the size_ check passes for a too-small buffer and the following ReadUnchecked loop walks off the end. Widening the multiplication to 64 bits keeps the bound correct everywhere; on 64-bit builds the comparison is unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
