You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "kawadakk (via GitHub)" <gi...@apache.org> on 2024/02/20 10:15:16 UTC

[I] OOB access in `Buffer::from_iter` [arrow-rs]

kawadakk opened a new issue, #5412:
URL: https://github.com/apache/arrow-rs/issues/5412

   **Describe the bug**
   When overflow checks are disabled, `<Buffer as FromIterator<T>>::from_iter` may construct `MutableBuffer` with a smaller capacity due to wrap-around arithmetic, causing out-of-bounds write.
   <https://github.com/apache/arrow-rs/blob/5bb226cc791adfd6903497cbb8fcd8285fe6f298/arrow-buffer/src/buffer/immutable.rs#L424-L438>
   <https://github.com/apache/arrow-rs/blob/5bb226cc791adfd6903497cbb8fcd8285fe6f298/arrow-buffer/src/buffer/mutable.rs#L71-L72>
   <https://github.com/apache/arrow-rs/blob/5bb226cc791adfd6903497cbb8fcd8285fe6f298/arrow-buffer/src/util/bit_util.rs#L32-L43>
   
   **To Reproduce**
   The following code segfaults in release build:
   
   ```rust
   // Trigger wrap-wround in `Buffer::from_iter`
   arrow_buffer::buffer::Buffer::from_iter(
       std::iter::repeat(42u64).take(usize::MAX / std::mem::size_of::<u64>() + 1));
   ```
   
   ```rust
   // Trigger wrap-wround in `bit_util::round_upto_multiple_of_64`
   arrow_buffer::buffer::Buffer::from_iter(
       std::iter::repeat(42u64).take(usize::MAX / std::mem::size_of::<u64>()));
   ```
   
   **Expected behavior**
   Panicking, aborting, or successful UB-free execution
   
   **Additional context**
   <!--
   Add any other context about the problem here.
   -->


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] OOB access in `Buffer::from_iter` [arrow-rs]

Posted by "tustvold (via GitHub)" <gi...@apache.org>.
tustvold closed issue #5412: OOB access in `Buffer::from_iter`
URL: https://github.com/apache/arrow-rs/issues/5412


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] OOB access in `Buffer::from_iter` [arrow-rs]

Posted by "tustvold (via GitHub)" <gi...@apache.org>.
tustvold commented on issue #5412:
URL: https://github.com/apache/arrow-rs/issues/5412#issuecomment-1972590244

   `label_issue.py` automatically added labels {'arrow'} from #5417


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] OOB access in `Buffer::from_iter` [arrow-rs]

Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey commented on issue #5412:
URL: https://github.com/apache/arrow-rs/issues/5412#issuecomment-1956463364

   Nice find :eyes: 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org