pedrobtz opened a new pull request, #1005: URL: https://github.com/apache/arrow-nanoarrow/pull/1005
`ArrowArrayViewValidateFull()` bounds each list view and large list view element as `offset + size > child_len`. Both values have already been checked to be non-negative, but for a large list view two large values overflow the `int64_t` sum, which is undefined behaviour. In practice the sum wraps to a negative number, so an element that points far past the child passes full validation. UBSan reports it as `signed integer overflow: 9223372036854775807 + 9223372036854775807 cannot be represented in type 'int64_t'`. The check is now `size > child_len - offset`, which cannot overflow once both are non-negative. The error message is unchanged. `ArrayViewTestLargeListView` now also validates an element with offset and size both `INT64_MAX` against a child of length 1. It expects `EINVAL` and the usual message. Without the fix, full validation returns `NANOARROW_OK` and the test fails, and under UBSan it stops at the addition. The input was found by fuzzing the IPC reader in the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors nanoarrow. `ctest` passes in a plain build and with ASan and UBSan (410 tests). The changed files are formatted with the pinned clang-format 16.0.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
