AIKIDO-2026-286955

TL;DR

The Matrix and ComplexMatrix types in peroxide expose their data, row, and col fields publicly, and the internal unsafe code that backs matrix operations trusts these fields without checking that the buffer length matches row * col. Safe code can construct a matrix whose data length disagrees with its dimensions, and operations that reach the raw-pointer, BLAS, and index-arithmetic paths then read and write past the end of the heap buffer. This makes heap out-of-bounds reads and writes reachable without any unsafe in user code, allowing memory corruption and disclosure of adjacent heap memory. The fix makes the fields crate-private and adds a length assertion in the matrix and cmatrix constructors so the invariant can no longer be broken from outside the crate.