Panic in `SerializedArray::from_flatbuffer_and_segment` (unchecked `BufferHandle::slice`)

[lorenzhs]

What happened?

Found another panic by fuzzing. Here's Claude's summary of what is going wrong here:

Array deserialization trusts the flatbuffer-declared buffer length/offset and slices the backing segment via BufferHandle::slice without bounds-checking against the segment length. When a declared buffer extends past its segment, Buffer::slice_with_alignment panics rather than returning VortexError. In a downstream reader the panic unwinds into a destructor that panics during cleanup (panic_in_cleanup), producing a non-unwinding abort() that catch_unwind cannot contain.

Steps to reproduce

Here's the repro, gzipped then base64'ed because GitHub doesn't like vortex files as attachments:

H4sICCMbWmoAA3NjYW5fcGxhbl9uYXRpdmVfb29iX3NsaWNlX2Fib3J0LnZvcnRleAC1F0toG1dw
niTLiq06aiuMGkzqQwg+FJNDKW0pJQ1pCKW4gRjjQ4izltbxtmvJXa1dRZSSg0+hpxxCjqGEHooP
OYTQQw49GB9CCKGnHEIxpZgQSgm0t0Tezrw3T/u0b2U3rftgdvfNzJuZN7+3b2Z69hTgeA5qFBEK
+Mzhs4DfRxByCILp6j0CFchLvhKUcUYjL3nHEEpSBq3L9azVo8a4DEKW5ZeY1l93BkpC6T5k6R6F
c/icRjjNNhCuglx55Bvsai4hVu5CVHivepAtlQK/M7bNN/id6/EDwFCCL+m/D3hNnrWY67PWPCvX
AL+v7EQR4G4n0J4yyyb+ryVeybyBC88hbOH3LYRZ5tmUPKNwkm04xvjJiPDp+x833mTPgEEfjZQ8
8u9xhLd79Aih424O6cty/BaG/2h8LmXmpT5tD9HPIV75Ix4zrH9f4pzpjXOmx+qXz22RWJ+WnxdA
xeZTw+6xXezu689C/E7mKI3LvJmOYVcHMjjw48/0OuvN0Tg3C8YcII6dmbNXOxiXs+F7bqvqLode
o870tY7KUfqeQMaHoOpe5kxHxf0MqDhq/R9yLpGvU/OT40Z9IMP+SebpDzv7lyda3zjYuXtlJ70e
vol2r4ekTDPHf+F6nxW99f6Q653WFYXCXeV6eAL/Lq/M3EmrCQ1lyZGW03lYxOcF9rOtW+++3NUt
4xqk+Fmkx7W3LpUd/+Xc0foK+Chk4znAXuee7stp+g/Js6GSoh/29OH+9YVuXqWcXTS2+B21oktR
WwhkyuRy+eG9+0HWkqX7hN6jrj/SuynzsgTTQu1H5/CPiM8ylz73N0DVp/bPy8bWrPtr+3g+jOf7
1/3/HkfRvz/QuMXBfV+0EVrdWKfFUfck7SctS6TOVY7f4x7kJ3rQXe5BA2zjFqj/jcuwe37vSzxE
/E7Go93nH8JP+Yf4XvIesHivM6/Zb37uI3eDeZNnvp27B3bN3U/Ofjb1cSsMnGr4URA4l37ivv6X
8vNgsh9VmE42PmNbxiPFG58HINYh5tM9bEPRBpRfyc5BXcOipmgFrY9ofO4LhRuRGMYNqjwbwj0V
ZAT5/1eY/VLmi5Kbpe/bypdCGDyrbGOZcQR1Z8kFjpkTBKyhqzur7KHc0TbmhT4vtNwmy/VqOi8p
dhWZb2qHIDn0Gj1ozTGhZBVxZZK/aPCTfY8RFhlXVme+XFsx+KSPx1Vf0DVNtD8wxkXovVMRbz5S
ePPsoHoL95B/PCF/KrLlE34hRb6qjxHpK+XTnMzfpH+0LOVLFf0iU/rZ1dJ+Zdp2il0Z1q9rROtP
2inA7JeUwzmpR+e62V9eg+TIyf7SW7P/4F8FUu4O+j5j3BXLXQ6qi5z0DdWFz3uazik/011M18n2
8yii9ysIq40gdFuTzTBYqYak54WiFU2aE1Jqw2GmDce0Bd8J4U2c30clNxHWEGoIpxEmEIoIv6Od
9xHWEdYQagjvIoxl1MYeoXPuCnWfvIxwAeGkUP/uOYTfQJ3XNxHWQP3LH4c45+7YdrWbYQ0evLD2
2fYutp2LOH/KtFdj2qoTzHv1Vc/9irzZsdYqOs6P2rSu/06k0JadoEnN5TzTDho098sVt151oW2v
C1bqbp32eo1ppZi2HHhLXuityp51h+lDBr3aAHjQsfxSX/F92LZ1LTnNL1zSldmxbPS9Zii9cnjH
kkc0eMfGLzQRP8X4UQPvtdzaXNNru3NyKQQ7lu1uK1R3nITMmoce/o7xbxh4t+otOf7c/KXQnUNf
y2S9x3wjFh/mP9PKBs0J3dBbcvVyGIosP1QbdSyFeghHI0t2dXGlLh14wl5Hds03Gj6cj6w9Sfxq
ZNWc4y8HFA55tib8gzS8a0ZxDBecZug7dbc5GfiUEJuptIUGXn/gV8O+mFZz/dCBZG97vYdn3guX
nSptchB0vwRAU2R/afH8Ns+PccO7mVHzR/wzdCTLfX9DnwDxSTnK/askPUHVRLf0t0B33yHsiuov
gU/+7BM08+RB6I6nfPJfx8f6iMYOoeTedQ9R+eNiTC8n6GeQ/u2wmgi8Y81Mz576Gyh7c/uuFAAA

Just run vx inspect on that and you get

File: fuzz2.vortex
Size: 5294 bytes

=== EOF Marker ===
Version: 1 (current: 1)
Postscript size: 160 bytes
Magic bytes: VTXF (VALID)

=== Postscript ===
  DType: offset=2956, length=336, alignment=8
  Layout: offset=3292, length=464, alignment=8
  Statistics: offset=3756, length=152, alignment=8
  Footer: offset=3908, length=1256, alignment=8

thread 'main' (484278) panicked at .../vortex-buffer/src/buffer.rs:370:13:
Other error: range end out of bounds: 844424931558400 > 5294
Backtrace:
   0: vortex_buffer::buffer::Buffer<T>::slice_with_alignment
   1: vortex_file::open::VortexOpenOptions::populate_initial_segments
   2: vortex_file::open::VortexOpenOptions::open::{{closure}}
   3: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
   4: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
   5: vortex_tui::inspect::exec_inspect::{{closure}}
   6: vortex_tui::native_cli::launch_from::{{closure}}
   7: vx::main::{{closure}}
   8: vx::main
   9: std::sys::backtrace::__rust_begin_short_backtrace
  10: std::rt::lang_start::{{closure}}
  11: std::rt::lang_start_internal
  12: main
  13: __libc_start_call_main
             at ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
  14: __libc_start_main_impl
             at ./csu/../csu/libc-start.c:360:3
  15: _start

stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: vortex_buffer::buffer::Buffer<T>::slice_with_alignment
   3: vortex_file::open::VortexOpenOptions::populate_initial_segments
   4: vortex_file::open::VortexOpenOptions::open::{{closure}}
   5: vortex_file::open::VortexOpenOptions::open_path::{{closure}}
   6: vortex_tui::inspect::VortexInspector::read_footer::{{closure}}
   7: vortex_tui::inspect::exec_inspect::{{closure}}
   8: vortex_tui::native_cli::launch_from::{{closure}}
   9: vx::main::{{closure}}
  10: vx::main
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Environment

develop as of 3975895

Additional context

No response