apache / apache/arrow-java

Byte-array elements leak in `FromSchemaByteArray()`

未關閉 適合新手
#1,205 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
Type: bug
主要語言
Java
星號
94
分支
152
平均合併
3 天 16 小時
30 天內合併 PR
11

描述

### Describe the bug, including details regarding any error messages, version, and platform.

I found a possible JNI array leak in `FromSchemaByteArray()` when the serialized schema cannot be parsed.

File: `dataset/src/main/cpp/jni_util.cc`

Function: `FromSchemaByteArray`

Relevant code:

```cpp
jbyte* schemaBytes_data =
env->GetByteArrayElements(schemaBytes, nullptr);
auto serialized_schema = std::make_shared(
reinterpret_cast(schemaBytes_data),
schemaBytes_len);
arrow::io::BufferReader buf_reader(serialized_schema);

ARROW_ASSIGN_OR_RAISE(
std::shared_ptr schema,
arrow::ipc::ReadSchema(&buf_reader, &in_memo))

env->ReleaseByteArrayElements(
schemaBytes, schemaBytes_data, JNI_ABORT);
return schema;
```

`GetByteArrayElements()` returns a pointer that must be paired with
`ReleaseByteArrayElements()`.

`ARROW_ASSIGN_OR_RAISE` returns immediately when `ReadSchema()` returns an
error. On that path, the release below the macro is skipped, so the acquired
array elements remain unreleased:

```text
GetByteArrayElements succeeds
-> ReadSchema returns an error
-> ARROW_ASSIGN_OR_RAISE returns
-> ReleaseByteArrayElements is skipped
```

The function is used by the public native `createDataset()` method:

```cpp
schema = JniGetOrThrow(
FromSchemaByteArray(env, schema_bytes));
```

Malformed, corrupted, or incompatible serialized schema bytes can therefore
reach this path. Repeated failed calls can retain copied array buffers or keep
Java arrays pinned, depending on the JVM implementation.

Suggested fix: release the elements before propagating the parse result, for
example:

```cpp
auto schema_result =
arrow::ipc::ReadSchema(&buf_reader, &in_memo);

env->ReleaseByteArrayElements(
schemaBytes, schemaBytes_data, JNI_ABORT);

return schema_result;
```

An RAII guard for `schemaBytes_data` would also ensure release if additional
early returns are introduced later.

貢獻指南

開啟貢獻指南

研究方向

從 dataset/src/main/cpp/jni_util.cc 中的 FromSchemaByteArray() 開始,檢查 GetByteArrayElements、ReadSchema 和 ReleaseByteArrayElements 的流程。確認剖析失敗時也會執行釋放,然後透過 createDataset() 執行格式錯誤或不相容 schema 的路徑;當取得的 JNI 陣列元素在成功和錯誤路徑上都被釋放時,即表示完成。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
cpp, java
領域
backend
Issue 類型
缺陷
難度
2/5
預估耗時
1-3 小時
活躍度
冷清
描述清晰度
描述清楚
新手友好度
85/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。