As discussed in the opened PR, I think Yiming Li reported and fixed a valid
issue. The change tracks back to this broad performance PR #3565 [1]
I took a deeper look at that PR, with Codex's help, and may have discovered
another, similar problem.
Here's a test case that will fail on master
@Test
public void testDictionaryPageCopyDoesNotAliasSourceBytes() throws
IOException {
byte[] source = {1, 0, 0, 0, 'a'};
DictionaryPage copied = new DictionaryPage(BytesInput.from(source), 1,
PLAIN).copy();
source[4] = 'b';
PlainBinaryDictionary dictionary = new PlainBinaryDictionary(copied);
assertThat(dictionary.decodeToBinary(0).toStringUsingUTF8()).isEqualTo("a");
}
The javadoc for BytesInput.copy(BytesInput) promises a copy [2], but now
returns a reference in some circumstances through BytesInput.toByteArray()
[3]. Changing the public contract alone might be an issue, but it also
seems to allow for unexpected data corruption.
I'll have a PR for this shortly and discussion can move there.
-- Aaron
[1] https://github.com/apache/parquet-java/pull/3565
[2]
https://github.com/apache/parquet-java/blob/b25bf1ed8f9b06e18454f781a18e921546cd3d9b/parquet-common/src/main/java/org/apache/parquet/bytes/BytesInput.java#L195-L205
[3]
https://github.com/apache/parquet-java/blob/b25bf1ed8f9b06e18454f781a18e921546cd3d9b/parquet-common/src/main/java/org/apache/parquet/bytes/BytesInput.java#L693-L705
On Fri, Aug 14, 2026 at 12:31 PM Yiming Li via dev <[email protected]>
wrote:
> Hi Parquet Dev Team,
>
> I’d like to request a review for PR #3717
> <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716
> <https://github.com/apache/parquet-java/issues/3716>).
>
> *Why this is urgent for 1.18.x:*
>
> -
>
> *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively
> upgrading to 1.18.0 to address critical *Jackson CVEs*.
> -
>
> *Adoption Blocker:* However, 1.18.0 introduced a silent data
> corruption bug in ByteBufferBackedBinary.getBytes() when reading
> repeated/array columns. This makes upgrading to 1.18.0 unsafe for
> production.
>
> *Summary of Fix:* PR #3717
> <https://github.com/apache/parquet-java/pull/3717> updates getBytes() and
> toStringUsingUTF8() to .duplicate() the buffer before adjusting
> limits/positions so shared page-wide buffers aren't clobbered during lazy
> record assembly. Regression tests covering this pattern have been added.
>
> Getting this fix reviewed and merged so it can be included in a 1.18.1
> patch release would allow ouor product to upgrade safely and resolve the
> Jackson CVEs.
>
> Thanks,
>
> Yiming Li
>
> VMware Tanzu Greenplum, Broadcom
>
--
Aaron Niskode-Dossett, Data Engineering -- Etsy
