You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "pedrobtz (via GitHub)" <gi...@apache.org> on 2026/10/21 21:58:25 UTC
[PR] fix: Reject lengths whose buffer sizes overflow int64 in minimal validation [arrow-nanoarrow]
pedrobtz opened a new pull request, #988:
URL: https://github.com/apache/arrow-nanoarrow/pull/988
`ArrowArrayViewValidateMinimal()` checks that `offset + length` fits an `int64_t`, then multiplies it by the element size to get each buffer's minimum size. For a fixed-size list it multiplies by the list size to get the child's minimum length. Neither product is checked. A large length overflows the product, which is undefined behaviour. In practice it wraps, and can wrap to a small size that then passes. For an `int32` array of length 2^62 + 1, `32 * 4611686018427387905` overflows. Without this change, validation returns `NANOARROW_OK` with a 16-byte data buffer.
The length is now checked against each buffer's element size in bits before any size is computed, with room for the round-up to whole bytes. It is also checked against the list size before the fixed-size list child length is computed. Lengths that fit behave as before.
The new `ArrayViewTestBufferSizeOverflow` test validates both cases at the minimal level and expects `EINVAL`. Without the fix, UBSan reports the overflow and the int32 case returns `NANOARROW_OK`.
Found by fuzzing the IPC reader in the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors nanoarrow. An IPC field node can declare any length, and `ArrowIpcArrayStreamReader` reached this overflow at full validation.
`ctest` passes in a plain Debug build and with ASan and UBSan (410 tests each). The changed files are formatted with the pinned clang-format 16.0.6.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: Reject lengths whose buffer sizes overflow int64 in minimal validation [arrow-nanoarrow]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #988:
URL: https://github.com/apache/arrow-nanoarrow/pull/988#issuecomment-6407779048
## [Codecov](https://app.codecov.io/gh/apache/arrow-nanoarrow/pull/988?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 78.58%. Comparing base ([`55df060`](https://app.codecov.io/gh/apache/arrow-nanoarrow/commit/55df06001d6c13294642fa3b741ac4e316553b3e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`c5f84db`](https://app.codecov.io/gh/apache/arrow-nanoarrow/commit/c5f84db7af0b4625a0ba0ba726489cd2e64bc421?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 4 commits behind head on main.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #988 +/- ##
==========================================
- Coverage 78.59% 78.58% -0.02%
==========================================
Files 106 106
Lines 17153 17162 +9
Branches 2043 2043
==========================================
+ Hits 13482 13487 +5
- Misses 2422 2426 +4
Partials 1249 1249
```
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/arrow-nanoarrow/pull/988?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org