tonyroberts opened a new pull request, #50843: URL: https://github.com/apache/arrow/pull/50843
### Rationale for this change Fixes issue 45086 by fixing a heap heap buffer overflow in FillNullForward/Backward on chunked boolean arrays. ### What changes are included in this PR? FillNullForwardChunked and FillNullBackwardChunked sized each output chunk's data buffer as `type->byte_width() * chunk->length()`. For BooleanType, byte_width() returns 0 (bit_width() / 8, truncated by integer division), so the buffer was allocated with 0 bytes while the chunk's declared length was unchanged, and filling it wrote real bit data past the end of the allocation. Add DataType::bytes_required(num_elements), a virtual method alongside byte_width()/bit_width() that correctly rounds up for bit-packed types, and use it at both call sites instead of the byte_width()-based calculation. Add regression tests exercising fill-null-forward and fill-null-backward on a chunked boolean array with a chunk large enough to reproduce the crash. ### Are these changes tested? Yes, and a new unit test has been added. ### Are there any user-facing changes? No. ### AI Disclosure Claude was used to help fix this issue, but all the code has been reviewed and tested locally (on Windows only, built using gcc). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
