Hanayoshi-8744 commented on PR #51559: URL: https://github.com/apache/arrow/pull/51559#issuecomment-6194249869
Hi @kou, regarding "Does the CVE really affect Apache Parquet C++?": I looked into it, and I think it most likely does not with the default settings. I also owe an apology: the PR description says this change is relevant to Arrow, which overstated the impact. I had only confirmed that the fix is in Thrift 0.24.0, not whether it is reachable through Arrow's defaults. Arrow's `ThriftDeserializer` (the only place where Arrow reads Thrift data) passes a container size limit (default 1,000,000) to `TCompactProtocolT`, and Thrift checks it before the overflowing multiplication in `checkReadBytesAvailable`. I confirmed this with a small harness mimicking Arrow's setup, fed with a list header claiming 2^28 UUIDs (the case from the upstream regression test, https://github.com/apache/thrift/commit/983c813c9a). With 0.22.0 (unoptimized build) it is rejected with `SIZE_LIMIT` at the default limit, and the size check is bypassed only if the limit is raised to well over 100 million or disabled (0, possible only via the C++ API). 0.24.0 rejects it in all cases. Caveats: I only tested a list header on macOS arm64 with clang, not an end-to-end malicious file or Windows. So I don't think the CVE alone justifies a backport, though that is your call. (This analysis was done with the help of an AI tool, Claude Code; I reviewed the results.) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
