Jefffrey opened a new issue, #11855: URL: https://github.com/apache/arrow-rs/issues/11855
### Describe the bug https://github.com/apache/arrow-rs/blob/d03274a7f69d9ec18e2d74920f8b880dd0a722a0/arrow-data/src/data.rs#L1532-L1542 line 1539 we always expand the null buffer if the parent fixedsizelist has a null buffer; this is never used when child null count is 0, or child is supposed to be non-nullable. impact is if we accept input from ipc and validate, given a massive element size then this expansion can cause a panic due to OOM, especially if the child array has no backing buffers (e.g. null array) - theoretically a crafted small input can cause massive memory allocation because of this expansion leading to unavoidable panic ### To Reproduce _No response_ ### Expected behavior it would be nice if the expansion could be made fallible, but the underlying issue is certain cases we dont need the expansion at all. so two fixes can be done here, but they form a whole solution ### Additional context Reported by Adam Korczynski from ADA Logics, identified by Anthropic -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
