[I] `take_record_batch` reads out of bounds when the first column's type has no width [arrow-rs]

["mbutrovich (via GitHub)" <gi...@apache.org>]

mbutrovich opened a new issue, #11825:
URL: https://github.com/apache/arrow-rs/issues/11825

   ### Describe the bug
   
   Since #10945, `take_record_batch` checks indices only through the first column's take, and takes the other columns unchecked ([take.rs](https://github.com/apache/arrow-rs/blob/01a9917658fecd639991e92a5a5810be710b539c/arrow-select/src/take.rs#L1708-L1728)). The first column's take reads no index when its type has no width: `Null`, a struct with no fields, `FixedSizeList` of size 0, and `FixedSizeBinary(0)`, the last three without nulls. An index out of bounds then reaches the unchecked reads, from a safe function. No release contains #10945.
   
   ### To Reproduce
   
   ```rust
   use std::sync::Arc;
   
   use arrow_array::{ArrayRef, Int32Array, NullArray, RecordBatch};
   use arrow_schema::{DataType, Field, Schema};
   use arrow_select::take::take_record_batch;
   
   fn main() {
       // A Null column first, then an Int32 column, 2 rows each
       let schema = Arc::new(Schema::new(vec![
           Field::new("n", DataType::Null, true),
           Field::new("a", DataType::Int32, true),
       ]));
       let batch = RecordBatch::try_new(
           schema,
           vec![Arc::new(NullArray::new(2)) as ArrayRef, Arc::new(Int32Array::from(vec![1, 2]))],
       )
       .unwrap();
   
       // Index 2 is one past the end
       let out = take_record_batch(&batch, &Int32Array::from(vec![2])).unwrap();
       println!("{:?}", out.column(1));
       // debug: aborts with "unsafe precondition(s) violated: slice::get_unchecked requires that the index is within the slice"
       // release: [0], read from past the end of "a"
   }
   ```
   
   ### Expected behavior
   
   A panic, as `take` documents for an index out of bounds when bounds are not checked, or an error.
   
   ### Additional context
   
   #10945 also puts nulls in non-nullable columns, filed as #11824.
   
   Found with property-based tests that build arrays in every physical layout the Arrow format allows, on `main` at `01a991765`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] `take_record_batch` reads out of bounds when the first column's type has no width [arrow-rs]

["Jefffrey (via GitHub)" <gi...@apache.org>]

Jefffrey closed issue #11825: `take_record_batch` reads out of bounds when the first column's type has no width
URL: https://github.com/apache/arrow-rs/issues/11825


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] `take_record_batch` reads out of bounds when the first column's type has no width [arrow-rs]

["mbutrovich (via GitHub)" <gi...@apache.org>]

mbutrovich commented on issue #11825:
URL: https://github.com/apache/arrow-rs/issues/11825#issuecomment-6348487915

   take


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org