pedrobtz opened a new pull request, #988: URL: https://github.com/apache/arrow-nanoarrow/pull/988
`ArrowArrayViewValidateMinimal()` checks that `offset + length` fits an `int64_t`, then multiplies it by the element size to get each buffer's minimum size. For a fixed-size list it multiplies by the list size to get the child's minimum length. Neither product is checked. A large length overflows the product, which is undefined behaviour. In practice it wraps, and can wrap to a small size that then passes. For an `int32` array of length 2^62 + 1, `32 * 4611686018427387905` overflows. Without this change, validation returns `NANOARROW_OK` with a 16-byte data buffer. The length is now checked against each buffer's element size in bits before any size is computed, with room for the round-up to whole bytes. It is also checked against the list size before the fixed-size list child length is computed. Lengths that fit behave as before. The new `ArrayViewTestBufferSizeOverflow` test validates both cases at the minimal level and expects `EINVAL`. Without the fix, UBSan reports the overflow and the int32 case returns `NANOARROW_OK`. Found by fuzzing the IPC reader in the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors nanoarrow. An IPC field node can declare any length, and `ArrowIpcArrayStreamReader` reached this overflow at full validation. `ctest` passes in a plain Debug build and with ASan and UBSan (410 tests each). The changed files are formatted with the pinned clang-format 16.0.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
