pedrobtz opened a new pull request, #985: URL: https://github.com/apache/arrow-nanoarrow/pull/985
When a file does not end with `ARROW1`, `ArrowIpcDecoderPeekFooter()` reports `"Expected file to end with ARROW1 but got %s"` with `data_end`, which points one byte past the end of the input. The input is not NUL-terminated, so `%s` reads past the buffer until it finds a zero byte. The message now prints the six bytes that were compared, with `%.6s` on `magic`. The existing `NanoarrowIpcFooterDecodingErrors` case passes a string literal, which happens to have a NUL just past its end, so it never showed the over-read. The new case copies the same ten bytes into a heap buffer of exactly that size and checks the message. Without the fix, ASan reports a heap-buffer-overflow there. Found by fuzzing the IPC reader in the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors nanoarrow. `ctest` passes with ASan and UBSan (409 tests). The changed files are formatted with the pinned clang-format 16.0.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
