decode of malformed file yields array which panics in arrow when consumed

[lorenzhs]

What happened?

decode of a malformed file yields a primitive array whose declared length exceeds its values buffer; consuming it panics in arrow (arrow-buffer/scalar.rs:91: offset overflow):

thread 'main' (617551) panicked at .../arrow-buffer-58.3.0/src/buffer/scalar.rs:91:52:
offset overflow
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::option::expect_failed
   3: arrow_buffer::buffer::scalar::ScalarBuffer<T>::slice
   4: arrow_array::array::primitive_array::PrimitiveArray<T>::slice
   5: <arrow_array::array::primitive_array::PrimitiveArray<T> as arrow_array::array::Array>::slice
   6: vortex_tui::datafusion_helper::arrow_value_to_json
   7: vortex_tui::query::batch_to_json_rows
   8: vortex_tui::native_cli::launch_from::{{closure}}
   9: vx::main::{{closure}}
  10: vx::main

Steps to reproduce

https://4z2.de/fuzz5.vortex
sha256sum: edfe9494b9fbe4bf794aee8d6d573e4f5c2006d11107fe0c95474d4d00c7385f

Environment

develop as of 10b8173

Additional context

No response

[lorenzhs]

btw this one segfaults duckdb 1.5.4:

(lldb) bt
* thread #1, name = 'duckdb', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x39e3000)
  * frame #0: 0x00000000009d1020 duckdb`void duckdb::ColumnDataCopy<int>(duckdb::ColumnDataMetaData&, duckdb::UnifiedVectorFormat const&, duckdb::Vector&, unsigned long, unsigned long) + 1024
    frame #1: 0x00000000009cbdf7 duckdb`void duckdb::ColumnDataCopy<duckdb::list_entry_t>(duckdb::ColumnDataMetaData&, duckdb::UnifiedVectorFormat const&, duckdb::Vector&, unsigned long, unsigned long) + 903
    frame #2: 0x00000000009d2fbf duckdb`duckdb::ColumnDataCollection::Append(duckdb::ColumnDataAppendState&, duckdb::DataChunk&) + 895
    frame #3: 0x0000000001a8eb85 duckdb`duckdb::PhysicalBatchCollector::Sink(duckdb::ExecutionContext&, duckdb::DataChunk&, duckdb::OperatorSinkInput&) const + 37
    frame #4: 0x0000000000df82ec duckdb`duckdb::PipelineExecutor::ExecutePushInternal(duckdb::DataChunk&, duckdb::ExecutionBudget&, unsigned long) + 508
    frame #5: 0x0000000000df86d8 duckdb`duckdb::PipelineExecutor::Execute(unsigned long) + 328
    frame #6: 0x0000000000df8a42 duckdb`duckdb::PipelineTask::ExecuteTask(duckdb::TaskExecutionMode) + 338
    frame #7: 0x0000000000df17b6 duckdb`duckdb::ExecutorTask::Execute(duckdb::TaskExecutionMode) + 214
    frame #8: 0x0000000000dfaba4 duckdb`duckdb::Executor::ExecuteTask(bool) + 116
    frame #9: 0x0000000000dace10 duckdb`duckdb::ClientContext::ExecuteTaskInternal(duckdb::ClientContextLock&, duckdb::BaseQueryResult&, bool) + 80
    frame #10: 0x0000000000dad04c duckdb`duckdb::PendingQueryResult::ExecuteInternal(duckdb::ClientContextLock&) + 60
    frame #11: 0x0000000000dad1f6 duckdb`duckdb::PendingQueryResult::Execute() + 54
    frame #12: 0x0000000000db10e0 duckdb`duckdb::ClientContext::Query(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::QueryParameters) + 768
    frame #13: 0x0000000000db1b2d duckdb`duckdb::Connection::SendQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::QueryParameters) + 45
    frame #14: 0x000000000085e653 duckdb`duckdb_shell::ShellState::ExecuteStatement(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>) + 339
    frame #15: 0x000000000085e957 duckdb`duckdb_shell::ShellState::ExecuteSQL(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) + 359
    frame #16: 0x0000000000868f9e duckdb`duckdb_shell::ShellState::RunInitialCommand(char const*, bool) + 94
    frame #17: 0x0000000000857699 duckdb`duckdb_shell::MetadataResult duckdb_shell::RunCommand<true>(duckdb_shell::ShellState&, duckdb::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, true, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) + 73
    frame #18: 0x000000000086a7f7 duckdb`RunShell(int, char const**) + 2727
    frame #19: 0x000000000083afff duckdb`main + 31
    frame #20: 0x00007ffff782a1ca libc.so.6`__libc_start_call_main(main=(duckdb`main), argc=3, argv=0x00007fffffffd728) at libc_start_call_main.h:58:16
    frame #21: 0x00007ffff782a28b libc.so.6`__libc_start_main_impl(main=(duckdb`main), argc=3, argv=0x00007fffffffd728, init=<unavailable>, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fffffffd718) at libc-start.c:360:3
    frame #22: 0x0000000000840fee duckdb`_start + 46