mbutrovich opened a new issue, #12136: URL: https://github.com/apache/arrow-rs/issues/12136
### Describe the bug `BooleanBufferBuilder` lets callers set bits at or past `len` in the last byte. [`set_bit`](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-buffer/src/builder/boolean.rs#L73-L86) only panics when `index / 8 >= as_slice().len()`. [`as_slice_mut`](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-buffer/src/builder/boolean.rs#L361) and `validity_slice_mut` on [`PrimitiveBuilder`](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-array/src/builder/primitive_builder.rs#L401) and [`GenericByteBuilder`](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-array/src/builder/generic_bytes_builder.rs#L264) expose the whole byte. Appends OR new bits into that byte, so a bit set past `len` reads back as `true` after a later `false` is appended. `append`, `append_slice`, `append_word`, `append_n(_, false)`, `resize`, and `advance` all have this bug. `extend_trusted_len` does not, because it [clears the partial byte](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-buffer/src/buffer/mutable.rs#L844-L848) first. ### To Reproduce ```rust use arrow_buffer::BooleanBufferBuilder; let mut builder = BooleanBufferBuilder::new(8); builder.append(true); builder.set_bit(1, true); builder.append(false); assert_eq!(builder.finish().iter().collect::<Vec<_>>(), [true, false]); let mut builder = BooleanBufferBuilder::new(8); builder.append(true); builder.set_bit(1, true); builder.resize(2); assert_eq!(builder.finish().iter().collect::<Vec<_>>(), [true, false]); ``` Both assertions fail on `main` (30c5c3287c). Each builder holds `[true, true]`. ### Expected behavior Appending `false` reads back as `false`, whatever bits past `len` held before. The [`resize` documentation](https://github.com/apache/arrow-rs/blob/30c5c3287cd5b99ca9aa0aec57509d076eb07347/arrow-buffer/src/builder/boolean.rs#L171-L172) already promises this for `resize`. ### Additional context #11879 proposes a fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
