[I] [C++][Gandiva] Out-of-bounds read in round(int, precision) for the most negative precision [arrow]

["Arawoof06 (via GitHub)" <gi...@apache.org>]

Arawoof06 opened a new issue, #50544:
URL: https://github.com/apache/arrow/issues/50544

   Describe the bug, including details regarding any error messages, version, and platform.
   
   `round_int32_int32` and `round_int64_int32` in `cpp/src/gandiva/precompiled/extended_math_ops.cc` negate the caller-supplied precision into `abs_precision` and only then apply the range check (`abs_precision > 9` and `abs_precision > 18` respectively).
   
   For `precision == INT32_MIN` the negation leaves the value unchanged and still negative, so both range checks evaluate false. The negative value is then passed to `get_power_of_10`, which indexes a 19-element static table guarded only by `DCHECK_GE`/`DCHECK_LE`. Those compile out in release builds, so the read lands far outside the table.
   
   Reachable from SQL as `round(int_col, -2147483648)`; both overloads are registered in `function_registry_arithmetic.cc`.
   
   In a debug build the DCHECK fires:
   
   ```
   extended_math_ops.cc:372:  Check failed: (exp) >= (0)
   ```
   
   In a release build there is no check and the indexed load faults or yields arbitrary memory as the rounding multiplier.
   
   `truncate_int64_int32` in the same file already compares the signed scale directly (`out_scale < -38`) and is not affected.
   
   Component(s)
   
   C++ - Gandiva


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read in round(int, precision) for the most negative precision [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou closed issue #50544: [C++][Gandiva] Out-of-bounds read in round(int, precision) for the most negative precision
URL: https://github.com/apache/arrow/issues/50544


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [C++][Gandiva] Out-of-bounds read in round(int, precision) for the most negative precision [arrow]

["kou (via GitHub)" <gi...@apache.org>]

kou commented on issue #50544:
URL: https://github.com/apache/arrow/issues/50544#issuecomment-6205757314

   Issue resolved by pull request 50545
   https://github.com/apache/arrow/pull/50545


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org