Byte-array elements leak in `FromSchemaByteArray()`
- Langage dominant
- Java
- Étoiles
- 94
- Forks
- 152
- Merge moyen
- 3 j 16 h
- PR mergées (30 j)
- 11
Description
### Describe the bug, including details regarding any error messages, version, and platform.
I found a possible JNI array leak in `FromSchemaByteArray()` when the serialized schema cannot be parsed.
File: `dataset/src/main/cpp/jni_util.cc`
Function: `FromSchemaByteArray`
Relevant code:
```cpp
jbyte* schemaBytes_data =
env->GetByteArrayElements(schemaBytes, nullptr);
auto serialized_schema = std::make_shared(
reinterpret_cast(schemaBytes_data),
schemaBytes_len);
arrow::io::BufferReader buf_reader(serialized_schema);
ARROW_ASSIGN_OR_RAISE(
std::shared_ptr schema,
arrow::ipc::ReadSchema(&buf_reader, &in_memo))
env->ReleaseByteArrayElements(
schemaBytes, schemaBytes_data, JNI_ABORT);
return schema;
```
`GetByteArrayElements()` returns a pointer that must be paired with
`ReleaseByteArrayElements()`.
`ARROW_ASSIGN_OR_RAISE` returns immediately when `ReadSchema()` returns an
error. On that path, the release below the macro is skipped, so the acquired
array elements remain unreleased:
```text
GetByteArrayElements succeeds
-> ReadSchema returns an error
-> ARROW_ASSIGN_OR_RAISE returns
-> ReleaseByteArrayElements is skipped
```
The function is used by the public native `createDataset()` method:
```cpp
schema = JniGetOrThrow(
FromSchemaByteArray(env, schema_bytes));
```
Malformed, corrupted, or incompatible serialized schema bytes can therefore
reach this path. Repeated failed calls can retain copied array buffers or keep
Java arrays pinned, depending on the JVM implementation.
Suggested fix: release the elements before propagating the parse result, for
example:
```cpp
auto schema_result =
arrow::ipc::ReadSchema(&buf_reader, &in_memo);
env->ReleaseByteArrayElements(
schemaBytes, schemaBytes_data, JNI_ABORT);
return schema_result;
```
An RAII guard for `schemaBytes_data` would also ensure release if additional
early returns are introduced later.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez dans dataset/src/main/cpp/jni_util.cc, au niveau de FromSchemaByteArray(), et inspectez le flux de GetByteArrayElements, ReadSchema et ReleaseByteArrayElements. Vérifiez que la libération a également lieu lorsque l’analyse échoue, puis exécutez le chemin d’un schéma malformé ou incompatible via createDataset() ; c’est terminé lorsque les éléments de tableau JNI acquis sont libérés sur les chemins de succès comme d’erreur.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- cpp, java
- Domaine
- backend
- Type d'issue
- Bug
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- Calme
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 85/100