Arawoof06 opened a new pull request, #50593:
URL: https://github.com/apache/arrow/pull/50593
### Rationale for this change
`evaluate_return_char_length` sizes the `lpad`/`rpad` output when the fill
text is more than one byte wide. It counts the fill glyphs with
`utf8_length_ignore_invalid`, which charges an invalid or truncated glyph a
single byte, then walks the fill text a second time stepping by the width
`utf8_char_length` declares, with no bound on `fill_index`. The two disagree on
malformed fill text: for `{0xE0, 'a', 'a'}` the count is 3 glyphs so the
partial-fill loop runs twice, while its first step consumes all 3 bytes and the
second read lands past the end of the fill buffer. It is reached from
`lpad(text, n, fill)` / `rpad(text, n, fill)` when `fill` comes from untrusted
string data. Reproduced under AddressSanitizer with that fill in an
exactly-sized heap buffer, giving `heap-buffer-overflow READ ... 0 bytes after
3-byte region`.
### What changes are included in this PR?
Bound the partial-fill walk by `fill_text_len` and step over each glyph the
way `utf8_length_ignore_invalid` counted it, so the two stay in sync.
Well-formed fill text is unaffected: every glyph fits inside the buffer and has
only continuation bytes after its lead byte, so neither the bound nor the
invalid-glyph handling comes into play.
### Are these changes tested?
Yes. `TestStringOps.TestPadMalformedUtf8FillNoOverread` runs `lpad`/`rpad`
with the truncated fill held in an exactly-sized heap buffer so the over-read
trips ASAN, and asserts the padded output. Before the fix it reports `out_len`
9 and trailing bytes read from past the buffer; after it reports 7. The rest of
`gandiva-precompiled-test` still passes.
### Are there any user-facing changes?
No.
**This PR contains a "Critical Fix".** It fixes an out-of-bounds read in the
Gandiva pad sizing helper reachable from `lpad`/`rpad` with crafted fill text.
* GitHub Issue: #50592
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
