Copilot commented on code in PR #3921:
URL: https://github.com/apache/avro/pull/3921#discussion_r3727460825
##########
lang/java/trevni/core/src/main/java/org/apache/trevni/ColumnValues.java:
##########
@@ -90,8 +90,12 @@ private void startBlock(int block) throws IOException {
this.row = column.firstRows[block];
in.seek(column.blockStarts[block]);
- int end = column.blocks[block].compressedSize;
- byte[] raw = new byte[end + checksum.size()];
+ // Validate the declared compressed size against the bytes remaining (after
+ // the seek) before allocating, and guard the addition of the checksum size
+ // against integer overflow, so a malformed, corrupted, or truncated file
+ // cannot drive an oversized or negative allocation.
+ int end = in.checkLength(column.blocks[block].compressedSize, 1);
+ byte[] raw = new byte[Math.addExact(end, checksum.size())];
in.readFully(raw);
Review Comment:
`Math.addExact(end, checksum.size())` can throw an unchecked
`ArithmeticException`, and the current `checkLength` only validates
`compressedSize` (not `compressedSize + checksum.size()`). This can still
allocate/read past the remaining bytes (e.g., a truncated file missing the
checksum) and may fail with a non-`IOException` despite the method contract.
##########
lang/java/trevni/core/src/test/java/org/apache/trevni/TestColumnFile.java:
##########
@@ -58,6 +61,33 @@ void emptyFile(ColumnFileMetaData fileMeta) throws Exception
{
in.close();
}
+ /** Byte offset of the little-endian 4-byte columnCount field in the header.
*/
+ private static final int COLUMN_COUNT_OFFSET = 12; // MAGIC(4) + rowCount
fixed64(8)
Review Comment:
Hard-coding `12` makes this test brittle if the magic size or fixed-width
encoding sizes change. You can compute the offset from existing constants to
keep the test self-describing and robust.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
