[I] [C++][Gandiva] Out-of-bounds read when formatting invalid date/timestamp error messages [arrow]

["Arawoof06 (via GitHub)" <gi...@apache.org>]

Arawoof06 opened a new issue, #50440:
URL: https://github.com/apache/arrow/issues/50440

   ### Describe the bug
   
   `set_error_for_date()` in `cpp/src/gandiva/precompiled/time.cc` builds the error message for an invalid date/timestamp with:
   
   ```c
   int size = length + static_cast<int>(strlen(msg)) + 1;
   char* error = reinterpret_cast<char*>(malloc(size));
   snprintf(error, size, "%s%s", msg, input);
   ```
   
   `input` is a Gandiva string given as pointer + `length`; it is not NUL-terminated (string values are stored contiguously in the Arrow values buffer). The `%s` conversion scans `input` for a NUL terminator, so it reads past the `length` bytes and, for the last value in a buffer, past the buffer end.
   
   It is reached from `castDATE_utf8` / `castTIMESTAMP_utf8` (i.e. `CAST(str AS DATE/TIMESTAMP)`) whenever the input is not a valid date/timestamp, which is fully attacker-controlled.
   
   Every other error formatter in the precompiled sources uses the bounded `%.*s` form with the explicit length. Using it here fixes the over-read.
   
   ### Component(s)
   
   C++, Gandiva


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read when formatting invalid date/timestamp error messages [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou commented on issue #50440:
URL: https://github.com/apache/arrow/issues/50440#issuecomment-5926232298

   Issue resolved by pull request 50441
   https://github.com/apache/arrow/pull/50441


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read when formatting invalid date/timestamp error messages [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou closed issue #50440: [C++][Gandiva] Out-of-bounds read when formatting invalid date/timestamp error messages
URL: https://github.com/apache/arrow/issues/50440


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org