You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@arrow.apache.org by al...@apache.org on 2026/10/22 15:09:10 UTC
(arrow-rs) branch 58_maintenance updated: [58_maintenance] Upgrade legacy Thrift dependency to 0.23 (#11365)
This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch 58_maintenance
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/58_maintenance by this push:
new e1f17b42c8 [58_maintenance] Upgrade legacy Thrift dependency to 0.23 (#11365)
e1f17b42c8 is described below
commit e1f17b42c80c50205d95743a8fe47ee786f8c4c3
Author: Beinan <be...@users.noreply.github.com>
AuthorDate: Thu Oct 22 08:09:03 2026 -0700
[58_maintenance] Upgrade legacy Thrift dependency to 0.23 (#11365)
Parquet 58 still depends on Thrift 0.17, which is affected by
GHSA-2f9f-gq7v-9h6m. Upgrade the legacy Thrift dependency to 0.23 on
`58_maintenance`, preserving the Arrow/Parquet 58 APIs for downstream
readers such as Paimon.
Add regressions for compact-protocol Statistics round trips and
rejection of an oversized binary field before allocation. The existing
internal Parquet decoder is unchanged.
Validation: `cargo +stable test -p parquet --lib` passes all 1,090
tests, including the 12 Thrift-related tests; formatting and `git diff
--check` pass.
---------
Co-authored-by: Beinan Wang <be...@microsoft.com>
Co-authored-by: Jeffrey Vo <je...@gmail.com>
Co-authored-by: Andrew Lamb <an...@nerdnetworks.org>
Co-authored-by: Claude Fable 5.1 <no...@anthropic.com>
---
Cargo.lock | 11 ++++++-----
parquet/Cargo.toml | 2 +-
parquet/src/thrift.rs | 38 ++++++++++++++++++++++++++++++++++++++
3 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 68cfcec11d..45dad5c410 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2286,9 +2286,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
[[package]]
name = "ordered-float"
-version = "2.10.1"
+version = "3.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+checksum = "f1e1c390732d15f1d48471625cd92d154e66db2c56645e29a9cd26f4699f72dc"
dependencies = [
"num-traits",
]
@@ -3369,7 +3369,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
"once_cell",
"rustix",
"windows-sys 0.61.2",
@@ -3442,13 +3442,14 @@ dependencies = [
[[package]]
name = "thrift"
-version = "0.17.0"
+version = "0.23.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
+checksum = "1f650151e44bb59950b3adf32de0064813d1148f34f4884b7f5b539f29596859"
dependencies = [
"byteorder",
"integer-encoding",
"ordered-float",
+ "uuid",
]
[[package]]
diff --git a/parquet/Cargo.toml b/parquet/Cargo.toml
index cc87b20d05..b8f6f7ec70 100644
--- a/parquet/Cargo.toml
+++ b/parquet/Cargo.toml
@@ -51,7 +51,7 @@ parquet-variant-compute = { workspace = true, optional = true }
object_store = { workspace = true, optional = true, features = ["tokio"] }
bytes = { version = "1.1", default-features = false, features = ["std"] }
-thrift = { version = "0.17", default-features = false }
+thrift = { version = "0.23", default-features = false }
snap = { version = "1.0", default-features = false, optional = true }
brotli = { version = "8.0", default-features = false, features = ["std"], optional = true }
# To use `flate2` you must enable either the `flate2-zlib-rs` or `flate2-rust_backened` backends
diff --git a/parquet/src/thrift.rs b/parquet/src/thrift.rs
index 2eb91162ac..9a3a66e578 100644
--- a/parquet/src/thrift.rs
+++ b/parquet/src/thrift.rs
@@ -37,6 +37,44 @@ mod tests {
file::page_index::{column_index::ColumnIndexMetaData, index_reader::decode_column_index},
};
+ #[test]
+ #[allow(deprecated)]
+ fn legacy_statistics_reject_oversized_binary_before_allocation() {
+ use crate::{format::Statistics, thrift::TSerializable};
+ use thrift::{Error, ProtocolErrorKind, protocol::TCompactInputProtocol};
+
+ // Field 1 (max), binary length 100 MiB + 1, and no payload. The length
+ // must be rejected before allocating the claimed buffer or reading it.
+ let bytes = [0x18, 0x81, 0x80, 0x80, 0x32];
+ let mut input = TCompactInputProtocol::new(bytes.as_slice());
+ let error = Statistics::read_from_in_protocol(&mut input).unwrap_err();
+ assert!(
+ matches!(error, Error::Protocol(error) if error.kind == ProtocolErrorKind::SizeLimit)
+ );
+ }
+
+ #[test]
+ #[allow(deprecated)]
+ fn legacy_statistics_compact_protocol_roundtrip() {
+ use crate::{format::Statistics, thrift::TSerializable};
+ use thrift::protocol::{TCompactInputProtocol, TCompactOutputProtocol};
+
+ let expected = Statistics {
+ min_value: Some(vec![0, 1, 255]),
+ max_value: Some(vec![255, 0, 1]),
+ null_count: Some(7),
+ ..Default::default()
+ };
+ let mut bytes = Vec::new();
+ expected
+ .write_to_out_protocol(&mut TCompactOutputProtocol::new(&mut bytes))
+ .unwrap();
+ let actual =
+ Statistics::read_from_in_protocol(&mut TCompactInputProtocol::new(bytes.as_slice()))
+ .unwrap();
+ assert_eq!(actual, expected);
+ }
+
#[test]
pub fn read_boolean_list_field_type() {
// Boolean collection type encoded as 0x01, as used by this crate when writing.