matanper opened a new pull request, #1290:
URL: https://github.com/apache/arrow-go/pull/1290

   ### Rationale for this change
   
   Reading valid VARIANT metadata with 126 dictionary keys and two-byte offsets 
panics with `slice bounds out of range [255:1]`. The metadata offset cursor 
inherits `uint8` from `offsetSz`; both advancing the cursor and computing the 
slice end can wrap at byte 256. Three- and four-byte offset tables hit the same 
problem with even fewer keys.
   
   This also affects current main after #1063: validating the complete offset 
table does not prevent the cursor arithmetic from overflowing while reading 
that valid table.
   
   ### What changes are included in this PR?
   
   Use an `int` offset width and cursor for indexing the metadata buffer. Keep 
the wire-format width and existing metadata validation unchanged.
   
   Add synthetic valid-metadata tests immediately before, at, and after the 
failure boundary for two-, three-, and four-byte offsets, plus larger 
dictionaries. Check every decoded dictionary key. No external test data is 
required.
   
   ### Are these changes tested?
   
   - Before the fix, `go test ./parquet/variant -run 
TestMetadataOffsetTableCrossesByteBoundary -count=1` reproduces the panic at 
`width_2/keys_126`.
   - After the fix, `go test ./parquet/variant ./arrow/extensions` passes, 
including all 13 new boundary cases.
   
   ### Are there any user-facing changes?
   
   Valid VARIANT dictionaries spanning byte 255 decode successfully instead of 
panicking. There are no public API or format changes.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to