Nayana-Naik73 opened a new pull request, #54911:
URL: https://github.com/apache/arrow/pull/54911
### Rationale for this change
`UnionConverter::AppendValue` in `arrow/json/from_string.cc` reads the
`type_id` of each `[type_id, value]` pair as an int64, truncates it to int8 and
uses it straight away as an index into `type_id_to_child_num_`, which only has
`max_type_code() + 1` entries. The `-1` "not found" check runs after that
lookup. So with `dense_union({a: int8, b: bool}, {4, 8})`, input `[[100, 1]]`
reads past the end of the vector (ASan heap out-of-bounds read at
from_string.cc:867), and `[[-1, 1]]` reads before its start. The garbage child
number is then used to index `child_converters_`, and the code makes a virtual
call through that `shared_ptr`. Ids above 127 also wrap: `[[260, 1]]` is
currently accepted as type code 4.
### What changes are included in this PR?
The int64 `type_id` is range-checked against the lookup table before the
cast. Out-of-range ids get the same `Invalid` "type_id ... not found" error
that unknown codes already get.
### Are these changes tested?
Yes. `TestDenseUnionFromString.Errors` and
`TestSparseUnionFromString.Errors` now cover `-1`, `100` and `260`. On the
unpatched code they trip UBSan/ASan, and with the fix they pass. The full
`arrow-json-test` suite passes under an ASan/UBSan debug build.
### Are there any user-facing changes?
`ArrayFromJSONString`, `ScalarFromJSONString` and
`ChunkedArrayFromJSONString` now return `Invalid` for union type ids outside
the type's codes. Before, these reads were out of bounds or wrapped to another
type code.
**This PR contains a "Critical Fix".** A union `type_id` in the JSON input
could cause an out-of-bounds read, followed by a virtual call through an
out-of-bounds `shared_ptr`, in the public `ArrayFromJSONString` /
`ScalarFromJSONString` helpers.
### Was AI used for this PR?
In accordance to the [AI generation
guidelines](https://arrow.apache.org/docs/dev/developers/overview.html#ai-generated-code),
please disclose below whether and how AI was used in this PR.
**PR code and description written by:**
- [X] Human
- [x] AI
**Reviewed before submission by:**
- [x] Human
- [ ] AI
- [ ] Not reviewed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
