Nayana-Naik73 opened a new pull request, #55283: URL: https://github.com/apache/arrow/pull/55283
### Rationale for this change `DictByteArrayDecoderImpl::DecodeArrow` in `cpp/src/parquet/decoder.cc`, the path taken by `TypedDecoder<ByteArrayType>::DecodeArrow(..., BinaryDictionary32Builder*)` on a dictionary decoder when `null_count != 0`, refills a 1024-entry stack array with `idx_decoder_.GetBatch` and then consumes it until `i == num_indices`. Nothing checks that the refill returned any indices. When the RLE/bit-packed index stream of a data page is truncated or empty, a refill returns 0, so the loop re-reads stale entries, walks past the end of the array and keeps advancing the validity `BitmapReader` past `num_values`, appending values that were never requested. UBSan on the regression test below, against the current tree: ``` decoder.cc:1400:24: runtime error: index 1024 out of bounds for type 'int32_t[1024]' ``` The two sibling paths, `DecodeArrow` into a dense builder and `DecodeArrowNonNull`, already reject `num_indices < 1`. The file reader does not reach this overload (it uses `DecodeIndicesSpaced`), so this affects direct users of the decoder API. The encoding fuzzer only exercises the `null_count == 0` paths, which is why it was not caught there. ### What changes are included in this PR? The same `num_indices < 1` check the dense path uses, after the refill. ### Are these changes tested? Yes. `DictEncoding.CheckDecodeArrowDictBuilderTruncatedIndices` feeds a truncated index stream and expects a `ParquetException`. It trips UBSan before the fix and passes after. `parquet-encoding-test`, `parquet-internals-test`, `parquet-reader-test` and `parquet-arrow-reader-writer-test` pass under ASan/UBSan with the change. ### Are there any user-facing changes? No. Truncated input now fails with `Invalid number of indices: 0` instead of reading out of bounds. **This PR contains a "Critical Fix".** A truncated dictionary-encoded page passed to `DecodeArrow` with nulls reads past a stack array and past the validity bitmap. ### Was AI used for this PR? In accordance to the [AI generation guidelines](https://arrow.apache.org/docs/dev/developers/overview.html#ai-generated-code), please disclose below whether and how AI was used in this PR. **PR code and description written by:** - [x] Human - [x] AI **Reviewed before submission by:** - [x] Human - [ ] AI - [ ] Not reviewed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
