apache / apache/arrow-java

[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBs

Open Beginner friendly
#1,230 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
94
Forks
152
Avg merge
3d 16h
Merged PRs (30d)
11

Description

ClobConsumer copies CLOB data into the VarCharVector data buffer with `MemoryUtil.copyToMemory` at offset `startIndex + totalBytes`, but the buffer-growth guard checks `dataBuffer.writerIndex() + bytes.length > dataBuffer.capacity()`. `copyToMemory` never advances `writerIndex()`, and nothing else does either, so it stays at 0 and the guard only ever checks that a single chunk fits at offset 0. Once the cumulative bytes of a CLOB (or a batch of CLOB rows) exceed the initial data-buffer allocation of about 32 KB, `reallocDataBuffer()` is never called and `copyToMemory`, which performs no ArrowBuf bounds checking, writes past the allocation into adjacent off-heap memory.

The sibling `BinaryConsumer` uses the correct check: `while (vector.getDataBuffer().capacity() < (startOffset + dataLength + read))`.

To reproduce, consume a single CLOB whose UTF-8 length exceeds the initial data buffer (for example `INITIAL_VALUE_ALLOCATION * 8 * 4` characters). The out-of-bounds write corrupts the adjacent offset buffer, and reading the value back throws `NegativeArraySizeException`.

Contributor guide

Open the contributing guide

Research direction

Locate ClobConsumer and compare its VarCharVector data-buffer growth guard with the sibling BinaryConsumer check. Reproduce with a CLOB whose UTF-8 data exceeds the initial allocation, then verify that cumulative CLOB or batch data does not corrupt the offset buffer and can be read back successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, database
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.