pedrobtz opened a new pull request, #984: URL: https://github.com/apache/arrow-nanoarrow/pull/984
`ArrowIpcDecoderReadHeaderPrefix()` adds the 4- or 8-byte prefix to the message size read from the input, and stores the sum in the `int32_t` `decoder->header_size_bytes`. A message size near `INT32_MAX` overflows that sum, which is undefined behaviour. UBSan reports it as `signed integer overflow: 8 + 2147483647 cannot be represented in type 'int32_t'`. The size is now checked for that overflow before it is added. The negative-size check moves first, so it still runs before the sum. The new `NanoarrowIpcCheckHeaderSizeOverflow` test peeks a header with size `INT32_MAX` after the continuation marker, and a pre-0.15 header with size `INT32_MAX - 3`. Both now return `EINVAL`. Without the fix, the test fails under UBSan at the addition. The input was found by fuzzing the IPC reader in the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors nanoarrow. `ctest` passes with ASan and UBSan (410 tests). The changed files are formatted with the pinned clang-format 16.0.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
