You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "Arawoof06 (via GitHub)" <gi...@apache.org> on 2026/07/10 06:33:16 UTC
[PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Arawoof06 opened a new pull request, #50463:
URL: https://github.com/apache/arrow/pull/50463
### Rationale for this change
The multi-byte branch of `translate_utf8_utf8_utf8` (taken whenever the input, FROM, or TO contains a byte > 127) reads `gdv_fn_utf8_char_length` on a lead byte and then builds a `std::string` of that width from the buffer without checking how many bytes remain. A truncated trailing glyph in the input reads past IN, a multi-byte input character missing from FROM reads one byte past FROM at the end-of-list sentinel (the `from_for == from_len` check ran after the read), and a truncated glyph in TO reads past TO. All three are reachable from the SQL `translate(in, from, to)` call on truncated column data.
### What changes are included in this PR?
Clamp each utf8 character width to the bytes left in its buffer before copying, consuming a single byte on a truncated or invalid lead byte (which also stops a zero-width advance from looping forever), and move the FROM end-of-list check ahead of the read so the sentinel iteration no longer touches `from[from_len]`. Valid input keeps its existing grouping since the clamp only fires past the end.
### Are these changes tested?
Yes. Added two cases to `TestGdvFnStubs.TestTranslate`: a truncated trailing glyph in the input, and a valid multi-byte input char absent from FROM. Both use exact-sized buffers so ASAN trips on the pre-patch over-read and passes after the fix.
### Are there any user-facing changes?
No.
**This PR contains a "Critical Fix".** It fixes a heap out-of-bounds read (crash) in `translate` reachable from user-supplied string data.
* GitHub Issue: #50462
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "dmitry-chirkov-dremio (via GitHub)" <gi...@apache.org>.
dmitry-chirkov-dremio commented on code in PR #50463:
URL: https://github.com/apache/arrow/pull/50463#discussion_r3572598120
##########
cpp/src/gandiva/gdv_function_stubs_test.cc:
##########
@@ -1202,6 +1202,23 @@ TEST(TestGdvFnStubs, TestTranslate) {
EXPECT_STREQ(result, "");
EXPECT_THAT(ctx.get_error(),
::testing::HasSubstr("Would overflow maximum output size"));
+
Review Comment:
Nice fix.
I think the logic change is sound: moving the `from_for == from_len` check ahead of the read closes the one-byte over-read, and clamping invalid/truncated UTF-8 widths to 1 avoids both OOB reads and zero-width infinite loops.
The one thing still missing is a regression test for the to side, since this patch also changes `len_char_to` handling. Please add a case where `to` ends in a truncated or invalid multibyte lead byte so the third safety fix is covered too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on PR #50463:
URL: https://github.com/apache/arrow/pull/50463#issuecomment-4954295892
@dmitry-chirkov-dremio @lriggs @akravchukdremio @xxlaykxx Could you review this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #50463:
URL: https://github.com/apache/arrow/pull/50463#issuecomment-4932654098
:warning: GitHub issue #50462 **has been automatically assigned in GitHub** to PR creator.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou merged PR #50463:
URL: https://github.com/apache/arrow/pull/50463
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #50463:
URL: https://github.com/apache/arrow/pull/50463#issuecomment-4932654174
:warning: GitHub issue #50462 **has no components**, please add labels for components.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "Arawoof06 (via GitHub)" <gi...@apache.org>.
Arawoof06 commented on code in PR #50463:
URL: https://github.com/apache/arrow/pull/50463#discussion_r3576141168
##########
cpp/src/gandiva/gdv_function_stubs_test.cc:
##########
@@ -1202,6 +1202,23 @@ TEST(TestGdvFnStubs, TestTranslate) {
EXPECT_STREQ(result, "");
EXPECT_THAT(ctx.get_error(),
::testing::HasSubstr("Would overflow maximum output size"));
+
Review Comment:
Added it. New case maps a matched input char to a `to` that ends in a truncated 0xE2 lead byte, so the pre-patch build over-reads TO by 2 bytes (ASAN READ of size 3) and the clamp passes it through as the single byte. Covers the third fix now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-50462: [C++][Gandiva] fix out-of-bounds read in translate_utf8_utf8_utf8 [arrow]
Posted by "conbench-apache-arrow[bot] (via GitHub)" <gi...@apache.org>.
conbench-apache-arrow[bot] commented on PR #50463:
URL: https://github.com/apache/arrow/pull/50463#issuecomment-4989740158
After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit 1f3f40f16461d3d0945bdff1f0a1e674fde9bd9a.
There were no benchmark performance regressions. 🎉
The [full Conbench report](https://github.com/apache/arrow/runs/87572151825) has more details. It also includes information about 5 possible false positives for unstable benchmarks that are known to sometimes produce them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org