Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0129

Buffer overflow in `Clusterings::from_i32_column_major_order()`

Published May 2, 2026 · Updated May 13, 2026 · Assigned by RUSTSEC

Description

The `from_i32_column_major_order` method can create inconsistent internal
state. When `labels` length and `n_items` mismatch, `n_clusterings` becomes
`labels.len() / n_items` (truncated), but subsequent calls to `label()` use
indices that exceed the internal data bounds, causing a buffer overflow.

For example, `Clusterings::from_i32_column_major_order(&[1,2,3,4,5], 3)`
creates clusterings with `n_clusterings = 5/3 = 1`. Then
`clusterings.label(1, 0)` accesses index `1*3 = 3`, but only 3 elements
exist (indices 0,1,2), causing out-of-bounds access.

This can be triggered through safe public APIs —
`from_i32_column_major_order()` and `label()` — with no `unsafe` required
from the caller.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io dahl-salso >= 0.0.0-0, < 0.6.8 0.6.8 RUSTSEC-2026-0129

References