Apache DataSketches C++ vulnerabilities

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking input length; in the compressed format the size check could be defeated by a 32-bit overflow. A crafted or truncated sketch could cause a read past the end of the input, potentially large in the compressed case, leading to a crash and memory exposure. Affects versions from 3.1.0 before 5.3.0.

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize() can cause the decompressor to read past the end of compressed data, and in the hybrid flavor can cause a write outside an internal heap buffer due to unvalidated decoded row indices. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. Affects versions from 2.0.0-incubating before 5.3.0.

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (datasketches-cpp). When deserializing a sketch in LIST mode, the coupon count was read from input and used as the number of entries to copy into a fixed buffer of 8 entries without checking capacity. A crafted sketch could cause a write of up to 988 bytes past the end of the internal heap buffer, corrupting memory. Affects versions from 1.0.0-incubating before 5.3.0.

An out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (versions 4.1.0 to 5.3.0) occurs because the input size check did not include the preamble, allowing a truncated sketch to cause a read past the end. Additionally, the table size is computed in 32-bit arithmetic, which can wrap to zero, leading to an empty table and subsequent out-of-bounds reads and writes, corrupting heap memory.

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble after checking only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. This can cause a crash (denial of service) and could expose adjacent memory contents. Affects versions from 2.0.0-incubating before 5.3.0.