You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "Arawoof06 (via GitHub)" <gi...@apache.org> on 2026/07/06 07:18:44 UTC
[PR] GH-1217: validate view data offsets in BaseVariableWidthViewVector [arrow-java]
Arawoof06 opened a new pull request, #1218:
URL: https://github.com/apache/arrow-java/pull/1218
## What's Changed
Utf8View and BinaryView values longer than 12 bytes live in a separate data buffer, with the data-buffer index and offset stored inline in the view; when a vector is read from an IPC stream those fields come from untrusted input. BaseVariableWidthViewVector dereferenced them without checking that the index is present or that offset+length stays inside the data buffer, so a crafted view reads past the buffer (and returns arbitrary native heap when arrow.enable_unsafe_memory_access is set). Routed every out-of-line dereference (get, getDataPointer, hashCode, copyFrom, splitAndTransfer) through one getValidatedDataBuffer check so a bad view is rejected at the source rather than in each caller.
Closes #1217.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-1217: validate view data offsets in BaseVariableWidthViewVector [arrow-java]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1218:
URL: https://github.com/apache/arrow-java/pull/1218#issuecomment-4890138795
<!-- label_helper_comment -->
Thank you for opening a pull request!
Please label the PR with one or more of:
- bug-fix
- chore
- dependencies
- documentation
- enhancement
Also, add the 'breaking-change' label if appropriate.
See [CONTRIBUTING.md](https://github.com/apache/arrow-java/blob/main/CONTRIBUTING.md) for details.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-1217: validate view data offsets in BaseVariableWidthViewVector [arrow-java]
Posted by "Arawoof06 (via GitHub)" <gi...@apache.org>.
Arawoof06 commented on PR #1218:
URL: https://github.com/apache/arrow-java/pull/1218#issuecomment-5352713773
Could a maintainer add the bug-fix label? The format check is failing on missing labels and I can't set it myself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-1217: validate view data offsets in BaseVariableWidthViewVector [arrow-java]
Posted by "Arawoof06 (via GitHub)" <gi...@apache.org>.
Arawoof06 commented on PR #1218:
URL: https://github.com/apache/arrow-java/pull/1218#issuecomment-5925702598
No worries. Your fix in #1291 looks like the right call, and documenting that enable_unsafe_memory_access voids the guarantees is a good addition. Happy to defer to it, feel free to close this one out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] GH-1217: validate view data offsets in BaseVariableWidthViewVector [arrow-java]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on PR #1218:
URL: https://github.com/apache/arrow-java/pull/1218#issuecomment-5614186035
Hi @Arawoof06 sorry for the delay here. The underlying issue was brought to my attention separately and I have an alternate fix at https://github.com/apache/arrow-java/pull/1291.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org