You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "metsw24-max (via GitHub)" <gi...@apache.org> on 2026/04/15 10:44:04 UTC
[PR] Harden BinaryView JSON parsing with runtime validation and bounds checks [arrow]
metsw24-max opened a new pull request, #49758:
URL: https://github.com/apache/arrow/pull/49758
This change strengthens the JSON integration parser for BinaryView arrays by replacing debug-only assumptions with enforced runtime validation for untrusted input.
This patch introduces strict validation to ensure all BinaryView inputs are well-formed before being used.
Key improvements:
- Validate SIZE as non-negative and within int32 bounds before use
- Enforce exact length matching for INLINED payloads (both UTF-8 and hex-encoded)
- Validate BUFFER_INDEX and OFFSET as non-negative and within valid bounds
- Ensure referenced buffer slices (OFFSET, SIZE) stay within actual buffer limits
- Validate PREFIX_HEX length before parsing
- Replace DCHECK-based assumptions with Status::Invalid checks in all cases
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4264869173
Could you fix the lint failure?
BTW, why do you need this? Are you adding a new integration test for BinaryView?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4251456493
:warning: GitHub issue #49759 **has been automatically assigned in GitHub** to PR creator.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "metsw24-max (via GitHub)" <gi...@apache.org>.
metsw24-max commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4265740750
>BTW, why do you need this? Are you adding a new integration test for BinaryView?
Yes, this is for a new BinaryView integration test path.
The runtime validation changes add explicit checks for malformed JSON input (negative SIZE, inline length mismatch, and out-of-bounds variadic buffer references), so the integration tests are there to lock in those error behaviors and prevent regressions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4255473418
Could you use our PR template instead of removing it entirely?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden BinaryView JSON parsing with runtime validation and bounds checks [arrow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4251338818
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
Thanks for opening a pull request!
If this is not a [minor PR](https://github.com/apache/arrow/blob/main/CONTRIBUTING.md#Minor-Fixes). Could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose
Opening GitHub issues ahead of time contributes to the [Openness](http://theapacheway.com/open/#:~:text=Openness%20allows%20new%20users%20the,must%20happen%20in%20the%20open.) of the Apache Arrow project.
Then could you also rename the pull request title in the following format?
GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}
or
MINOR: [${COMPONENT}] ${SUMMARY}
See also:
* [Other pull requests](https://github.com/apache/arrow/pulls/)
* [Contribution Guidelines - Contributing Overview](https://arrow.apache.org/docs/developers/overview.html)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "conbench-apache-arrow[bot] (via GitHub)" <gi...@apache.org>.
conbench-apache-arrow[bot] commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4274379443
After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit c5a2f799cfe907731c46273cf678812848f8ee67.
There were no benchmark performance regressions. 🎉
The [full Conbench report](https://github.com/apache/arrow/runs/71967295772) has more details. It also includes information about 20 possible false positives for unstable benchmarks that are known to sometimes produce them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "metsw24-max (via GitHub)" <gi...@apache.org>.
metsw24-max commented on PR #49758:
URL: https://github.com/apache/arrow/pull/49758#issuecomment-4260652367
> Could you use our PR template instead of removing it entirely?
Updated the PR description to follow the template structure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-49759: [C++][Integration] Harden BinaryView JSON parsing with runtime validation [arrow]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou merged PR #49758:
URL: https://github.com/apache/arrow/pull/49758
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org