You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Pranav Lodha (Code Review)" <ge...@cloudera.org> on 2025/07/27 21:05:03 UTC
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Pranav Lodha has uploaded this change for review. ( http://gerrit.cloudera.org:8080/23177
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
A heap-based buffer overflow vulnerability was
identified in Apache ORC's C++ LZO decompression
implementation. Specially crafted malformed ORC
files can cause the decompressor to allocate
a 250-byte buffer followed by a 295-byte copy,
leading to memory corruption. This patch incorporates
fix P11 which corrects the unsafe memory copy,
mitigating the vulnerability.
Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
---
A source/orc/orc-1.7.9-patches/0011-ORC-1879-C-Fix-Heap-Buffer-Overflow-in-LZO-Decompression-.patch
1 file changed, 57 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/native-toolchain refs/changes/77/23177/2
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 2
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Posted by "Pranav Lodha (Code Review)" <ge...@cloudera.org>.
Pranav Lodha has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/23177 )
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
A heap-based buffer overflow vulnerability was
identified in Apache ORC's C++ LZO decompression
implementation. Specially crafted malformed ORC
files can cause the decompressor to allocate
a 250-byte buffer followed by a 295-byte copy,
leading to memory corruption. This patch incorporates
fix P11 which corrects the unsafe memory copy,
mitigating the vulnerability.
Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
---
M buildall.sh
A source/orc/orc-1.7.9-patches/0011-ORC-1879-C-Fix-Heap-Buffer-Overflow-in-LZO-Decompression-.patch
2 files changed, 58 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/native-toolchain refs/changes/77/23177/3
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 3
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Posted by "Quanlong Huang (Code Review)" <ge...@cloudera.org>.
Quanlong Huang has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/23177 )
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
A heap-based buffer overflow vulnerability was
identified in Apache ORC's C++ LZO decompression
implementation. Specially crafted malformed ORC
files can cause the decompressor to allocate
a 250-byte buffer followed by a 295-byte copy,
leading to memory corruption. This patch incorporates
fix P11 which corrects the unsafe memory copy,
mitigating the vulnerability.
Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Reviewed-on: http://gerrit.cloudera.org:8080/23177
Reviewed-by: Quanlong Huang <hu...@gmail.com>
Tested-by: Quanlong Huang <hu...@gmail.com>
---
M buildall.sh
A source/orc/orc-1.7.9-patches/0011-ORC-1879-C-Fix-Heap-Buffer-Overflow-in-LZO-Decompression-.patch
2 files changed, 58 insertions(+), 1 deletion(-)
Approvals:
Quanlong Huang: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 4
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Posted by "Quanlong Huang (Code Review)" <ge...@cloudera.org>.
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/23177 )
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
Patch Set 3: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 3
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Comment-Date: Wed, 17 Sep 2025 07:28:37 +0000
Gerrit-HasComments: No
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Posted by "Quanlong Huang (Code Review)" <ge...@cloudera.org>.
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/23177 )
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
Patch Set 2:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23177/2/buildall.sh
File buildall.sh:
http://gerrit.cloudera.org:8080/#/c/23177/2/buildall.sh@237
PS2, Line 237: p10
This should be "p11" to include the new patch.
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 2
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Comment-Date: Wed, 06 Aug 2025 14:34:12 +0000
Gerrit-HasComments: Yes
[native-toolchain-CR] IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
Posted by "Quanlong Huang (Code Review)" <ge...@cloudera.org>.
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/23177 )
Change subject: IMPALA-14269: Bump ORC C++ version to 1.7.9-p11 to fix heap buffer overflow
......................................................................
Patch Set 3: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/23177
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: native-toolchain
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I58c6723139054bf6a899a18e89b40fe6dc4fa356
Gerrit-Change-Number: 23177
Gerrit-PatchSet: 3
Gerrit-Owner: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Pranav Lodha <pr...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>
Gerrit-Comment-Date: Wed, 17 Sep 2025 07:29:07 +0000
Gerrit-HasComments: No