[I] [C++][Gandiva] Out-of-bounds read in utf8_length_ignore_invalid on truncated multi-byte input [arrow]

["Arawoof06 (via GitHub)" <gi...@apache.org>]

Arawoof06 opened a new issue, #50355:
URL: https://github.com/apache/arrow/issues/50355

   ### Describe the bug, including details regarding any error messages, version, and platform.
   
   `utf8_length_ignore_invalid` in `cpp/src/gandiva/precompiled/string_ops.cc` counts glyphs while tolerating invalid bytes. When it hits a byte that is not a valid continuation byte it extends `char_len`:
   
   ```cpp
   for (int j = 1; j < char_len; ++j) {
     if ((data[i + j] & 0xC0) != 0x80) {
       char_len += 1;
     }
   }
   ```
   
   The inner loop keeps reading `data[i + j]` as `char_len` grows, but it never rechecks the buffer end. If a value ends in a truncated multi-byte sequence (for example a `0xF0` lead byte followed by non-continuation bytes) `char_len` grows past the remaining bytes and the loop reads past `data_len`.
   
   The function is reached from untrusted string data through `lpad`/`rpad` (`lpad_utf8_int32_utf8`, `rpad_utf8_int32_utf8`), which call it on the input text before computing padding.
   
   Reproduced against a verbatim copy of the function under AddressSanitizer with the 4-byte input `{0xF0, 'a', 'a', 'a'}` in an exactly-sized heap buffer:
   
   ```
   ==ERROR: AddressSanitizer: heap-buffer-overflow
   READ of size 1 ... 0 bytes after 4-byte region
       #0 utf8_length_ignore_invalid
   ```
   
   The sibling helpers (`utf8_length`, `reverse_utf8`, `utf8_byte_pos`) already guard the equivalent access with `i + char_len > data_len`; this one does not.
   
   ### Component(s)
   
   C++, Gandiva
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read in utf8_length_ignore_invalid on truncated multi-byte input [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou commented on issue #50355:
URL: https://github.com/apache/arrow/issues/50355#issuecomment-4912926083

   Issue resolved by pull request 50356
   https://github.com/apache/arrow/pull/50356


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read in utf8_length_ignore_invalid on truncated multi-byte input [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou closed issue #50355: [C++][Gandiva] Out-of-bounds read in utf8_length_ignore_invalid on truncated multi-byte input
URL: https://github.com/apache/arrow/issues/50355


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org