jmestwa-coder opened a new pull request, #50038:
URL: https://github.com/apache/arrow/pull/50038

   ReadSparseCSXIndex sizes its indices/indptr buffer checks with 
`non_zero_length * byte_width` and `(shape + 1) * byte_width` in int64, but 
both come straight from the SparseTensor flatbuffer via 
GetSparseTensorMetadata. A non_zero_length near INT64_MAX wraps the product, so 
the size guard passes and the index Tensor is built over a buffer smaller than 
its shape. Use the checked helpers from tensor.cc.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to