You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@parquet.apache.org by Yiming Li via dev <de...@parquet.apache.org> on 2026/08/14 17:31:26 UTC
[PR REVIEW] [BLOCKER] GH-3716 / PR #3717: Data corruption in 1.18.0 blocking Jackson CVE upgrade
Hi Parquet Dev Team,
I’d like to request a review for PR #3717
<https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716
<https://github.com/apache/parquet-java/issues/3716>).
*Why this is urgent for 1.18.x:*
-
*Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively
upgrading to 1.18.0 to address critical *Jackson CVEs*.
-
*Adoption Blocker:* However, 1.18.0 introduced a silent data corruption
bug in ByteBufferBackedBinary.getBytes() when reading repeated/array
columns. This makes upgrading to 1.18.0 unsafe for production.
*Summary of Fix:* PR #3717
<https://github.com/apache/parquet-java/pull/3717> updates getBytes() and
toStringUsingUTF8() to .duplicate() the buffer before adjusting
limits/positions so shared page-wide buffers aren't clobbered during lazy
record assembly. Regression tests covering this pattern have been added.
Getting this fix reviewed and merged so it can be included in a 1.18.1
patch release would allow ouor product to upgrade safely and resolve the
Jackson CVEs.
Thanks,
Yiming Li
VMware Tanzu Greenplum, Broadcom
Re: [PR REVIEW] [BLOCKER] GH-3716 / PR #3717: Data corruption in 1.18.0 blocking Jackson CVE upgrade
Posted by Yiming Li via dev <de...@parquet.apache.org>.
Thanks Fokko, that will be very helpful with the 1.81.1 patch release!
On Mon, Aug 17, 2026 at 7:39 AM Fokko Driesprong <fo...@apache.org> wrote:
> Thanks for reporting this Yiming,
>
> GitHub is having some issues, but I'll take a look later today. We might
> want to follow up with a 1.18.1 patch release to fix this issue.
>
> Kind regards,
> Fokko Driesprong
>
> On 2026/08/14 17:31:26 Yiming Li via dev wrote:
> > Hi Parquet Dev Team,
> >
> > I’d like to request a review for PR #3717
> > <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716
> > <https://github.com/apache/parquet-java/issues/3716>).
> >
> > *Why this is urgent for 1.18.x:*
> >
> > -
> >
> > *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively
> > upgrading to 1.18.0 to address critical *Jackson CVEs*.
> > -
> >
> > *Adoption Blocker:* However, 1.18.0 introduced a silent data
> corruption
> > bug in ByteBufferBackedBinary.getBytes() when reading repeated/array
> > columns. This makes upgrading to 1.18.0 unsafe for production.
> >
> > *Summary of Fix:* PR #3717
> > <https://github.com/apache/parquet-java/pull/3717> updates getBytes()
> and
> > toStringUsingUTF8() to .duplicate() the buffer before adjusting
> > limits/positions so shared page-wide buffers aren't clobbered during lazy
> > record assembly. Regression tests covering this pattern have been added.
> >
> > Getting this fix reviewed and merged so it can be included in a 1.18.1
> > patch release would allow ouor product to upgrade safely and resolve the
> > Jackson CVEs.
> >
> > Thanks,
> >
> > Yiming Li
> >
> > VMware Tanzu Greenplum, Broadcom
> >
>
Re: [PR REVIEW] [BLOCKER] GH-3716 / PR #3717: Data corruption in 1.18.0 blocking Jackson CVE upgrade
Posted by Fokko Driesprong <fo...@apache.org>.
Thanks for reporting this Yiming,
GitHub is having some issues, but I'll take a look later today. We might want to follow up with a 1.18.1 patch release to fix this issue.
Kind regards,
Fokko Driesprong
On 2026/08/14 17:31:26 Yiming Li via dev wrote:
> Hi Parquet Dev Team,
>
> I’d like to request a review for PR #3717
> <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716
> <https://github.com/apache/parquet-java/issues/3716>).
>
> *Why this is urgent for 1.18.x:*
>
> -
>
> *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively
> upgrading to 1.18.0 to address critical *Jackson CVEs*.
> -
>
> *Adoption Blocker:* However, 1.18.0 introduced a silent data corruption
> bug in ByteBufferBackedBinary.getBytes() when reading repeated/array
> columns. This makes upgrading to 1.18.0 unsafe for production.
>
> *Summary of Fix:* PR #3717
> <https://github.com/apache/parquet-java/pull/3717> updates getBytes() and
> toStringUsingUTF8() to .duplicate() the buffer before adjusting
> limits/positions so shared page-wide buffers aren't clobbered during lazy
> record assembly. Regression tests covering this pattern have been added.
>
> Getting this fix reviewed and merged so it can be included in a 1.18.1
> patch release would allow ouor product to upgrade safely and resolve the
> Jackson CVEs.
>
> Thanks,
>
> Yiming Li
>
> VMware Tanzu Greenplum, Broadcom
>
Another possible data corruption issue in 1.18.0 (was: Re: [PR REVIEW] [BLOCKER] GH-3716 / PR #3717: Data corruption in 1.18.0 blocking Jackson CVE upgrade)
Posted by Aaron Niskode-Dossett via dev <de...@parquet.apache.org>.
As discussed in the opened PR, I think Yiming Li reported and fixed a valid
issue. The change tracks back to this broad performance PR #3565 [1]
I took a deeper look at that PR, with Codex's help, and may have discovered
another, similar problem.
Here's a test case that will fail on master
@Test
public void testDictionaryPageCopyDoesNotAliasSourceBytes() throws
IOException {
byte[] source = {1, 0, 0, 0, 'a'};
DictionaryPage copied = new DictionaryPage(BytesInput.from(source), 1,
PLAIN).copy();
source[4] = 'b';
PlainBinaryDictionary dictionary = new PlainBinaryDictionary(copied);
assertThat(dictionary.decodeToBinary(0).toStringUsingUTF8()).isEqualTo("a");
}
The javadoc for BytesInput.copy(BytesInput) promises a copy [2], but now
returns a reference in some circumstances through BytesInput.toByteArray()
[3]. Changing the public contract alone might be an issue, but it also
seems to allow for unexpected data corruption.
I'll have a PR for this shortly and discussion can move there.
-- Aaron
[1] https://github.com/apache/parquet-java/pull/3565
[2]
https://github.com/apache/parquet-java/blob/b25bf1ed8f9b06e18454f781a18e921546cd3d9b/parquet-common/src/main/java/org/apache/parquet/bytes/BytesInput.java#L195-L205
[3]
https://github.com/apache/parquet-java/blob/b25bf1ed8f9b06e18454f781a18e921546cd3d9b/parquet-common/src/main/java/org/apache/parquet/bytes/BytesInput.java#L693-L705
On Fri, Aug 14, 2026 at 12:31 PM Yiming Li via dev <de...@parquet.apache.org>
wrote:
> Hi Parquet Dev Team,
>
> I’d like to request a review for PR #3717
> <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716
> <https://github.com/apache/parquet-java/issues/3716>).
>
> *Why this is urgent for 1.18.x:*
>
> -
>
> *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively
> upgrading to 1.18.0 to address critical *Jackson CVEs*.
> -
>
> *Adoption Blocker:* However, 1.18.0 introduced a silent data
> corruption bug in ByteBufferBackedBinary.getBytes() when reading
> repeated/array columns. This makes upgrading to 1.18.0 unsafe for
> production.
>
> *Summary of Fix:* PR #3717
> <https://github.com/apache/parquet-java/pull/3717> updates getBytes() and
> toStringUsingUTF8() to .duplicate() the buffer before adjusting
> limits/positions so shared page-wide buffers aren't clobbered during lazy
> record assembly. Regression tests covering this pattern have been added.
>
> Getting this fix reviewed and merged so it can be included in a 1.18.1
> patch release would allow ouor product to upgrade safely and resolve the
> Jackson CVEs.
>
> Thanks,
>
> Yiming Li
>
> VMware Tanzu Greenplum, Broadcom
>
--
Aaron Niskode-Dossett, Data Engineering -- Etsy