mbutrovich opened a new issue, #11599:
URL: https://github.com/apache/arrow-rs/issues/11599

   ### Describe the bug
   
   `convert_rows` panics with an index out of bounds for a dense union when a 
type id is greater than or equal to the number of fields, for example a single 
field with type id 5. `convert_columns` succeeds on the same array.
   
   ### To Reproduce
   
   ```rust
   use std::sync::Arc;
   use arrow_array::{ArrayRef, Int32Array, UnionArray};
   use arrow_row::{RowConverter, SortField};
   use arrow_schema::{DataType, Field, UnionFields};
   
   fn main() {
       let fields = UnionFields::try_new([5], [Field::new("a", DataType::Int32, 
true)]).unwrap();
       let child: ArrayRef = Arc::new(Int32Array::from(vec![1, 2]));
       let union: ArrayRef = Arc::new(UnionArray::try_new(fields, vec![5i8, 
5].into(), Some(vec![0, 1].into()), vec![child]).unwrap());
       let conv = 
RowConverter::new(vec![SortField::new(union.data_type().clone())]).unwrap();
       let rows = conv.convert_columns(&[union]).unwrap();
       let _ = conv.convert_rows(&rows);
       // panics: index out of bounds: the len is 1 but the index is 5
   }
   ```
   
   ### Expected behavior
   
   `convert_rows` returns the union.
   
   ### Additional context
   
   To build the dense offsets, the decoder indexes its per-field counters by 
the type id 
([lib.rs](https://github.com/apache/arrow-rs/blob/72887ed91c80002bb7ec755ce1e964bab07bebea/arrow-row/src/lib.rs#L2475-L2482)).
 Earlier in the same function it maps type ids to field indexes with 
`type_id_to_field_idx` 
([lib.rs](https://github.com/apache/arrow-rs/blob/72887ed91c80002bb7ec755ce1e964bab07bebea/arrow-row/src/lib.rs#L2387-L2390)),
 which the offsets loop could use too. Sparse unions do not build offsets and 
are not affected.
   
   #9283 fixed the same kind of panic in encoding (#9263). Found with 
property-based tests that build arrays in every physical layout the Arrow 
format allows.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to