fix: Used checked_add for bounds checks to avoid UB

[etseidl]

Which issue does this PR close?

• Closes Soundness Bugs in this crate #9543.

Rationale for this change

See issue, but it is possible to construct arguments to arrow_buffer::bit_util::bit_mask::set_bits that overflow the bounds checking protecting unsafe code.

What changes are included in this PR?

Use checked_add when doing the bounds checking and panic when an overflow occurs.

Are these changes tested?

Yes

Are there any user-facing changes?

No

[jhorstmann]

Looks good. On 64-bit systems the len * 8 should also never overflow in practice. I'm not sure how well we support 32-bit systems, if we do we might need to take a look at more places where a length in bits is calculated.

[etseidl]

Looks good. On 64-bit systems the len * 8 should also never overflow in practice. I'm not sure how well we support 32-bit systems, if we do we might need to take a look at more places where a length in bits is calculated.

Agreed. I think the most likely scenario would be bad input resulting in ridiculous offsets. This will guard against that.