Jefffrey opened a new issue, #11857: URL: https://github.com/apache/arrow-rs/issues/11857
### Describe the bug https://github.com/apache/arrow-rs/blob/d03274a7f69d9ec18e2d74920f8b880dd0a722a0/arrow-ipc/src/reader.rs#L59-L74 `slice_with_length` could panic here as i dont believe offset & len are controlled/validated. we should ensure if an invalid slice is taken it should error, not panic ### To Reproduce ```rust #[test] fn test_read_record_batch_buffer_out_of_bounds() { use crate::r#gen::Message::{RecordBatch, RecordBatchArgs}; use flatbuffers::FlatBufferBuilder; let schema = Arc::new(Schema::new(vec![Field::new("col", DataType::Int32, false)])); let body = Buffer::from(vec![0u8; 8]); let mut fbb = FlatBufferBuilder::new(); let nodes = fbb.create_vector(&[FieldNode::new(2, 0)]); // Empty validity buffer followed by two Int32 values whose range exceeds the body. let buffers = fbb.create_vector(&[crate::Buffer::new(0, 0), crate::Buffer::new(4, 8)]); let batch = RecordBatch::create( &mut fbb, &RecordBatchArgs { length: 2, nodes: Some(nodes), buffers: Some(buffers), ..Default::default() }, ); fbb.finish_minimal(batch); let batch = flatbuffers::root::<RecordBatch>(fbb.finished_data()).unwrap(); let result = read_record_batch( &body, batch, schema, &HashMap::new(), None, &MetadataVersion::V5, ); assert!( result.is_err(), "invalid IPC buffer range must return an error" ); } ``` - test generated by codex output ```sh ---- reader::tests::test_read_record_batch_buffer_out_of_bounds stdout ---- thread 'reader::tests::test_read_record_batch_buffer_out_of_bounds' (1273563) panicked at arrow-buffer/src/buffer/immutable.rs:299:9: the offset of the new Buffer cannot exceed the existing length: slice offset=4 length=8 selflen=8 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: reader::tests::test_read_record_batch_buffer_out_of_bounds test result: FAILED. 141 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.54s ``` ### Expected behavior should error and not panic ### Additional context Reported by Adam Korczynski from ADA Logics, identified by Anthropic -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
