Nayana-Naik73 opened a new pull request, #54640: URL: https://github.com/apache/arrow/pull/54640
### Rationale for this change The view to offset-string cast (`binary_view`/`utf8_view` to `binary`, `utf8`, `large_binary`, `large_utf8`) reserves the output data buffer with `SumOfBinaryViewSizes` over every view, null slots included, and then copies each non-null value with `UnsafeAppend`. Views under a null bit are undefined and `ValidateFull` skips them, so a null view carrying a negative size (for example one read from an IPC or Parquet file) shrinks the reservation and the cast writes past the end of the output buffer. With `["foofoofoofoofoo", null, "barbarbarbarbarbarbar"]` and size -36 on the null view, the array passes `ValidateFull()` and ASan reports a WRITE overflow in `BufferBuilder::UnsafeAppend` from `BinaryToBinaryCastExec`. ### What changes are included in this PR? The reservation now only sums the sizes of valid views, walking the validity bitmap with `VisitSetBitRunsVoid`. ### Are these changes tested? Yes. `Cast.BinaryViewToBinaryNullViewSize` builds a `ValidateFull`-clean `utf8_view`/`binary_view` array with a negative size on the null view and casts it to all four offset types. It fails under ASan before the change and passes after; the rest of `arrow-compute-scalar-cast-test` passes too. ### Are there any user-facing changes? No. **This PR contains a "Critical Fix".** It fixes an out-of-bounds heap write in `cast` on valid input data whose null views hold a negative size. ### Was AI used for this PR? In accordance to the [AI generation guidelines](https://arrow.apache.org/docs/dev/developers/overview.html#ai-generated-code), please disclose below whether and how AI was used in this PR. **PR code and description written by:** - [x] Human - [x] AI **Reviewed before submission by:** - [x] Human - [ ] AI - [ ] Not reviewed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
