From 0edcc4fb0093b06228e792dea91976b4f9cbf9bf Mon Sep 17 00:00:00 2001
From: Tom Veasey <tveasey@elastic.co>
Date: Wed, 10 Aug 2022 15:51:27 +0100
Subject: [PATCH 1/3] Fix potential out-of-bounds read

---
 lib/maths/analytics/CBoostedTreeImpl.cc | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/maths/analytics/CBoostedTreeImpl.cc b/lib/maths/analytics/CBoostedTreeImpl.cc
index 55fc9d258..08effebf0 100644
--- a/lib/maths/analytics/CBoostedTreeImpl.cc
+++ b/lib/maths/analytics/CBoostedTreeImpl.cc
@@ -1663,16 +1663,18 @@ CBoostedTreeImpl::trainTree(core::CDataFrame& frame,
         this->nodeFeatureBag(treeFeatureBag, featureSampleProbabilities, nodeFeatureBag);
         nodeFeatureBag = merge(featuresToInclude, std::move(nodeFeatureBag));
 
-        std::size_t numberSplittableLeaves{splittableLeaves.size()};
-        std::size_t currentNumberInternalNodes{(tree.size() - 1) / 2};
+        auto numberSplittableLeaves =
+            static_cast<std::ptrdiff_t>(splittableLeaves.size());
+        auto currentNumberInternalNodes = static_cast<std::ptrdiff_t>(tree.size() - 1) / 2;
+        auto lastPotentialSplit =
+            numberSplittableLeaves + currentNumberInternalNodes -
+            static_cast<std::ptrdiff_t>(maximumNumberInternalNodes);
         auto smallestCurrentCandidateGainIndex =
-            static_cast<std::ptrdiff_t>(numberSplittableLeaves) -
-            static_cast<std::ptrdiff_t>(maximumNumberInternalNodes - currentNumberInternalNodes);
+            std::min(lastPotentialSplit, numberSplittableLeaves - 1);
         double smallestCandidateGain{
-            smallestCurrentCandidateGainIndex >= 0
-                ? splittableLeaves[static_cast<std::size_t>(smallestCurrentCandidateGainIndex)]
-                      ->gain()
-                : 0.0};
+            smallestCurrentCandidateGainIndex < 0
+                ? 0.0
+                : splittableLeaves[smallestCurrentCandidateGainIndex]->gain()};
 
         TLeafNodeStatisticsPtr leftChild;
         TLeafNodeStatisticsPtr rightChild;

From 731862fbfec46594a90d9ea0dbc61f5b683ca1d6 Mon Sep 17 00:00:00 2001
From: Tom Veasey <tveasey@elastic.co>
Date: Wed, 10 Aug 2022 16:03:40 +0100
Subject: [PATCH 2/3] Docs

---
 docs/CHANGELOG.asciidoc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc
index decc34c53..95ebecaf4 100644
--- a/docs/CHANGELOG.asciidoc
+++ b/docs/CHANGELOG.asciidoc
@@ -42,6 +42,10 @@
 * Improve accuracy of anomaly detection median estimation. (See {ml-pull}2367[#2367],
   issue: {ml-issue}2364[#2364].)
 
+=== Bug Fixes
+
+* Fix potential cause of classification and regression job failures. (See {ml-pull}2385[#2385].)
+
 == {es} version 8.3.0
 
 === Enhancements

From 7b6494d7538c940e019fd2034e6334b63189127d Mon Sep 17 00:00:00 2001
From: Tom Veasey <tveasey@elastic.co>
Date: Wed, 10 Aug 2022 17:12:24 +0100
Subject: [PATCH 3/3] Fix formatting

---
 lib/maths/analytics/CBoostedTreeImpl.cc | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/maths/analytics/CBoostedTreeImpl.cc b/lib/maths/analytics/CBoostedTreeImpl.cc
index 08effebf0..3ad4b380b 100644
--- a/lib/maths/analytics/CBoostedTreeImpl.cc
+++ b/lib/maths/analytics/CBoostedTreeImpl.cc
@@ -1666,9 +1666,8 @@ CBoostedTreeImpl::trainTree(core::CDataFrame& frame,
         auto numberSplittableLeaves =
             static_cast<std::ptrdiff_t>(splittableLeaves.size());
         auto currentNumberInternalNodes = static_cast<std::ptrdiff_t>(tree.size() - 1) / 2;
-        auto lastPotentialSplit =
-            numberSplittableLeaves + currentNumberInternalNodes -
-            static_cast<std::ptrdiff_t>(maximumNumberInternalNodes);
+        auto lastPotentialSplit = numberSplittableLeaves + currentNumberInternalNodes -
+                                  static_cast<std::ptrdiff_t>(maximumNumberInternalNodes);
         auto smallestCurrentCandidateGainIndex =
             std::min(lastPotentialSplit, numberSplittableLeaves - 1);
         double smallestCandidateGain{