HIGH

GHSA-h588-76vg-prgj

`DecimalArray` does not perform bound checks on accessing values and offsets

Details

`DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/arrow

Introduced in: 0Fixed in: 6.4.0

Upgrade arrow to 6.4.0 or newer (ecosystem crates.io).

References

https://github.com/apache/arrow-rs/issues/775[WEB]
https://github.com/apache/arrow-rs[WEB]
https://rustsec.org/advisories/RUSTSEC-2021-0117.html[WEB]