tonyroberts opened a new pull request, #50843:
URL: https://github.com/apache/arrow/pull/50843

   ### Rationale for this change
   
   Fixes issue 45086 by fixing a heap heap buffer overflow in 
FillNullForward/Backward on chunked boolean arrays.
   
   ### What changes are included in this PR?
   
   FillNullForwardChunked and FillNullBackwardChunked sized each output chunk's 
data buffer as `type->byte_width() * chunk->length()`. For BooleanType, 
byte_width() returns 0 (bit_width() / 8, truncated by integer division), so the 
buffer was allocated with 0 bytes while the chunk's declared length was 
unchanged, and filling it wrote real bit data past the end of the allocation.
   
   Add DataType::bytes_required(num_elements), a virtual method alongside 
byte_width()/bit_width() that correctly rounds up for bit-packed types, and use 
it at both call sites instead of the byte_width()-based calculation. Add 
regression tests exercising fill-null-forward and fill-null-backward on a 
chunked boolean array with a chunk large enough to reproduce the crash.
   
   ### Are these changes tested?
   
   Yes, and a new unit test has been added.
   
   ### Are there any user-facing changes?
   
   No.
   
   ### AI Disclosure
   
   Claude was used to help fix this issue, but all the code has been reviewed 
and tested locally (on Windows only, built using gcc).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to