This is an automated email from the ASF dual-hosted git repository.
wgtmac pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow.git
The following commit(s) were added to refs/heads/main by this push:
new ea3ca57eb31 GH-50292: [C++][Parquet] Avoid int64 overflow in
CheckReadRangeOrThrow (#50060)
ea3ca57eb31 is described below
commit ea3ca57eb31dcf90fe828ccaf06411fe08e16f7b
Author: metsw24-max <[email protected]>
AuthorDate: Tue Jun 30 14:26:35 2026 +0530
GH-50292: [C++][Parquet] Avoid int64 overflow in CheckReadRangeOrThrow
(#50060)
CheckReadRangeOrThrow adds index_location.offset + length unchecked, so a
column-chunk page-index location near INT64_MAX wraps past the bounds check and
yields an out-of-range buffer offset at read time; guard it with
AddWithOverflow as merge_range already does.
* GitHub Issue: #50292
Lead-authored-by: metsw24-max <[email protected]>
Co-authored-by: Sayed Kaif <[email protected]>
Signed-off-by: Gang Wu <[email protected]>
---
cpp/src/parquet/page_index.cc | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/cpp/src/parquet/page_index.cc b/cpp/src/parquet/page_index.cc
index 7434f2828da..1d2faebd251 100644
--- a/cpp/src/parquet/page_index.cc
+++ b/cpp/src/parquet/page_index.cc
@@ -335,9 +335,14 @@ class RowGroupPageIndexReaderImpl : public
RowGroupPageIndexReader {
}
/// Page index location must be within the range of the read range.
+ int64_t index_end = 0;
+ int64_t range_end = 0;
if (index_location.offset < index_read_range->offset ||
- index_location.offset + index_location.length >
- index_read_range->offset + index_read_range->length) {
+ ::arrow::internal::AddWithOverflow(index_location.offset,
index_location.length,
+ &index_end) ||
+ ::arrow::internal::AddWithOverflow(index_read_range->offset,
+ index_read_range->length,
&range_end) ||
+ index_end > range_end) {
throw ParquetException("Page index location [offset:",
index_location.offset,
",length:", index_location.length,
"] is out of range from previous WillNeed request
[offset:",
