Lucene search
+L

2 matches found

osv_rustsec
osv_rustsec
•added 2026/10/16 12:00 p.m.•11 views

RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...

5.9AI score
SaveExploits0References4
RustSec
RustSec
•added 2026/10/16 12:00 p.m.•8 views

Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...

5.9AI score
SaveExploits0Affected Software1
Rows per page
Query Builder