From c8ddaae3eac38640860a3f3d8c3ff65b7abdae07 Mon Sep 17 00:00:00 2001 From: Andrew Lamb Date: Fri, 24 Apr 2026 23:46:39 -0400 Subject: [PATCH] Prevent repeat slice length overflow --- arrow-buffer/src/buffer/mutable.rs | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/arrow-buffer/src/buffer/mutable.rs b/arrow-buffer/src/buffer/mutable.rs index 07ef965cb082..f4e532029b8e 100644 --- a/arrow-buffer/src/buffer/mutable.rs +++ b/arrow-buffer/src/buffer/mutable.rs @@ -284,9 +284,15 @@ impl MutableBuffer { } let bytes_to_repeat = size_of_val(slice_to_repeat); + let repeated_bytes = repeat_count + .checked_mul(bytes_to_repeat) + .expect("repeated slice byte length overflow"); + self.len + .checked_add(repeated_bytes) + .expect("mutable buffer length overflow"); // Ensure capacity - self.reserve(repeat_count * bytes_to_repeat); + self.reserve(repeated_bytes); // Save the length before we do all the copies to know where to start from let length_before = self.len; @@ -1474,6 +1480,21 @@ mod tests { test_repeat_count(0, &[1i32, 2, 3]); } + #[test] + #[should_panic(expected = "repeated slice byte length overflow")] + fn test_repeat_slice_count_multiply_overflow() { + let mut buffer = MutableBuffer::new(0); + buffer.repeat_slice_n_times(&[0_u64], usize::MAX / mem::size_of::() + 1); + } + + #[test] + #[should_panic(expected = "mutable buffer length overflow")] + fn test_repeat_slice_count_len_overflow() { + let mut buffer = MutableBuffer::new(0); + buffer.push(0_u8); + buffer.repeat_slice_n_times(&[0_u8], usize::MAX); + } + #[test] fn test_small_repeats_counts() { // test any special implementation for small repeat counts