Hi Parquet Dev Team, I’d like to request a review for PR #3717 <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716 <https://github.com/apache/parquet-java/issues/3716>).
*Why this is urgent for 1.18.x:* - *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively upgrading to 1.18.0 to address critical *Jackson CVEs*. - *Adoption Blocker:* However, 1.18.0 introduced a silent data corruption bug in ByteBufferBackedBinary.getBytes() when reading repeated/array columns. This makes upgrading to 1.18.0 unsafe for production. *Summary of Fix:* PR #3717 <https://github.com/apache/parquet-java/pull/3717> updates getBytes() and toStringUsingUTF8() to .duplicate() the buffer before adjusting limits/positions so shared page-wide buffers aren't clobbered during lazy record assembly. Regression tests covering this pattern have been added. Getting this fix reviewed and merged so it can be included in a 1.18.1 patch release would allow ouor product to upgrade safely and resolve the Jackson CVEs. Thanks, Yiming Li VMware Tanzu Greenplum, Broadcom
smime.p7s
Description: S/MIME Cryptographic Signature
