github-actions[bot] opened a new issue, #3549: URL: https://github.com/apache/iceberg-rust/issues/3549
> Out-of-bounds read in `train_from_buffer` when sample sizes overflow | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f](https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f) | | Date | 2026-10-16 | `ZDICT_trainFromBuffer` is never told the length of the samples buffer, so `train_from_buffer` checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the end of the buffer. `zstd::dict::from_continuous` relies on this check from zstd 0.4.10; older versions of zstd had their own, covered by a separate advisory. This requires the sample sizes to come from an untrusted source. The flaw was corrected by summing the sizes with overflow checks. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0401.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
