mbutrovich opened a new issue, #11587:
URL: https://github.com/apache/arrow-rs/issues/11587
### Describe the bug
Validation accepts a run-end encoded array whose `offset + len` is past its
last run end. Reading the rows past the last run then indexes past the end of
the values.
### To Reproduce
```rust
use std::sync::Arc;
use arrow_array::types::Int32Type;
use arrow_array::{ArrayRef, Int32Array, RunArray};
fn main() {
// Run ends [2, 3] cover 3 rows
let ree: ArrayRef =
Arc::new(RunArray::<Int32Type>::try_new(&Int32Array::from(vec![2, 3]),
&Int32Array::from(vec![7, 9])).unwrap());
let r = ree.to_data().into_builder().len(5).build();
println!("{}", r.is_ok()); // true, expected an error: rows 3 and 4 have
no run
}
```
### Expected behavior
`build` returns an error, as `check_run_ends` intends: its error message is
"The offset + length of array should be less or equal to last value in the
run_ends array".
### Additional context
`check_run_ends` is called on the run ends child,
`run_ends_data.check_run_ends::<T>()`
([data.rs](https://github.com/apache/arrow-rs/blob/72887ed91c80002bb7ec755ce1e964bab07bebea/arrow-data/src/data.rs#L1642-L1652)).
Inside it, `self.len` and `self.offset` are therefore the child's, the number
of runs, rather than the run-end encoded array's logical length and offset
([data.rs](https://github.com/apache/arrow-rs/blob/72887ed91c80002bb7ec755ce1e964bab07bebea/arrow-data/src/data.rs#L1824-L1829)).
After the build above, `RunArray::get_physical_index` returns 2 for rows 3 and
4, but the values have 2 entries.
Found with property-based tests that build arrays in every physical layout
the Arrow format allows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
