VrtxOmega opened a new pull request, #50947: URL: https://github.com/apache/arrow/pull/50947
Fixes #50472 Fix integer overflow in mask_utf8_utf8_utf8_utf8: the output buffer size multiplication (std::max of replacement lengths * data_len) is performed in int32_t without overflow checking. A large replacement string combined with large data_len causes wraparound, producing an undersized arena allocation and heap buffer overflow in the memcpy loop. Fix: use arrow::internal::MultiplyWithOverflow, consistent with sibling functions (repeat_utf8_int32, to_hex_binary, translate). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
