[I] DictionaryEncoder.decode accepts out-of-range dictionary indices [arrow-java]

["Arawoof06 (via GitHub)" <gi...@apache.org>]

Arawoof06 opened a new issue, #1261:
URL: https://github.com/apache/arrow-java/issues/1261

   `DictionaryEncoder.retrieveIndexVector` guards each index from the index vector with `indexAsInt > dictionaryCount` before `transfer.copyValueSafe(indexAsInt, i)`. Valid indices are `0..dictionaryCount-1`, so the check is off by one: an index equal to `dictionaryCount` is accepted and reads one slot past the dictionary vector, and a negative index (a signed index type with the high bit set) is not rejected either and also reaches `copyValueSafe`. The index vector is decoded from an IPC/C-data payload, so a crafted dictionary-encoded batch yields an out-of-bounds read of the dictionary vector, exposing adjacent off-heap memory when bounds checking is disabled via `arrow.enable_unsafe_memory_access`.
   
   The same helper backs `DictionaryEncoder.decode`, `ListSubfieldEncoder.decodeListSubField` and `StructSubfieldEncoder.decode`.
   
   The bound should be `indexAsInt < 0 || indexAsInt >= dictionaryCount`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] DictionaryEncoder.decode accepts out-of-range dictionary indices [arrow-java]

["jbonofre (via GitHub)" <gi...@apache.org>]

jbonofre closed issue #1261: DictionaryEncoder.decode accepts out-of-range dictionary indices
URL: https://github.com/apache/arrow-java/issues/1261


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org