RUSTSEC-2026-0401: Out-of-bounds read in `train_from_buffer` when sample sizes overflow
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
Research direction
Start by checking how this project depends on zstd-safe and whether its dictionary training path can pass untrusted sample sizes to train_from_buffer. Read the linked advisory and the cited zstd-rs fix for context. The issue says the flaw is fixed by summing sizes with overflow checks; done means confirming the affected dependency or call path is no longer vulnerable.
Written by the indexing model from the issue text.
Description
Out-of-bounds read in
train_from_bufferwhen sample sizes overflow
| Details | |
|---|---|
| Status | unsound |
| Package | zstd-safe |
| Version | 7.2.4 |
| URL | https://github.com/gyscos/zstd-rs/commit/781ea454191dbf178d09c1daf6fc896d15fbaa2f |
| Date | 2026-10-16 |
ZDICT_trainFromBuffer is never told the length of the samples buffer, so
train_from_buffer checked that the sample sizes add up to it. With
overflow checks off, as in release builds, that sum wrapped around: sizes
totalling 2^64 plus the buffer length passed the check, and the trainer read
past the end of the buffer. zstd::dict::from_continuous relies on this
check from zstd 0.4.10; older versions of zstd had their own, covered by a
separate advisory.
This requires the sample sizes to come from an untrusted source. The flaw
was corrected by summing the sizes with overflow checks.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 2
- Forks
- 0
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 4
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/stackable-odbc-trino
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in stackabletech/stackable-odbc-trino
Similar issues
-
ai_p2 bug comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ClickHouse/ClickHouse#128306 · 1 comment ·
Maintainers usually reply within 1 day
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
bug triage
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
area:cli bug priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day