wleeaf opened a new pull request, #11881: URL: https://github.com/apache/arrow-rs/pull/11881
# Which issue does this PR close? - Closes #11856. - Closes #11857. # Rationale for this change The IPC reader slices buffers using offsets and lengths that come from the message, without checking them against the data they point into. `Buffer::slice_with_length` panics when the range is out of bounds, so corrupt input panics instead of returning an error. # What changes are included in this PR? - A small `slice_buffer` helper in `reader.rs` that checks the range (the same condition `slice_with_length` asserts) and returns an `ArrowError::IpcError` instead of panicking. - `read_buffer` uses it for the buffer offset and length from the message metadata (#11857). - The union reader uses it for the type ids buffer and the dense offsets buffer, whose expected length comes from the field node (#11856). # Are these changes tested? Yes. The reproducers from both issues are added as `test_read_record_batch_buffer_out_of_bounds` and `test_union_short_buffers`. The union test also covers a dense union with a short offsets buffer. Both tests panic without the fix and pass with it. # Are there any significant user-facing changes? No. AI usage: this change was prepared with Claude Code (an AI coding agent). The fix and tests were generated by it and checked against the failing tests from the issues. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
