Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Arrow Array::insert Panics Can Cause Memory Corruption
published 4 months ago
Summary
Apache Arrow's Array::insert method is not designed to handle panics from user-provided compare functions. If a panic occurs, it can cause the program to free memory twice, leading to memory corruption. This issue has been fixed in version 3.8.4, so update to the latest version to ensure your data is safe.
What to do
- Update wvwwvwwv scc to version 3.8.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | wvwwvwwv | scc |
>= 0.0.0-0, < 3.8.4 Fix: upgrade to 3.8.4
|
Original advisory text
`Array::insert` violates exception safety if compare function panics, leading to potential Double-Free
In affected versions of this crate, `Array::insert` is not exception safe. In the `UPSERT` path, `key` and `value`'s snapshot is written to `self.data_block`, and after the insertion is completed, `key` and `value` are `mem::forget` in order to prevent double free. However, during the insertion, `K::compare` is invoked, which is a user-provided method. If user deliberately call panic in this function, during unwinding, the destructors of `key`, `value`, and `self` will all be called (since the `mem::forget` has not been called yet), leading to Double Free. Similar issues happens in the `!UPSERT` path.
The soundness issue was fixed in version `3.8.4` by using `ManuallyDrop` instead of `mem::forget`, and separating fallible code from infallible code during a node split - insert = insert_try -> insert_unchecked.
The soundness issue was fixed in version `3.8.4` by using `ManuallyDrop` instead of `mem::forget`, and separating fallible code from infallible code during a node split - insert = insert_try -> insert_unchecked.
References
Timeline
Published6 Jul 2026
Updated7 Jul 2026
First seen7 Jul 2026
Sources
RUSTSEC-2026-0205 · OSV
Track software like this
Free during beta