Process-memory disclosure or crash via pointer wraparound

Buffer overflow in Rockhopper 0.1.0 through 0.1.2 allows local users to read process memory or crash the process via crafted binary data. The count_rows function trusts a uint64 row length and advances its raw pointer without checking whether the arithmetic wraps below the input buffer. Exploitation requires local execution of RaggedArray.loads on attacker-controlled data; the result is an in-process memory read or a segmentation fault.