apache / apache/arrow-java

ArrowFlightJdbcArray.getArray(index, count) can read past the end of the array slice

Open Beginner friendly
#1,236 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
94
Forks
152
Avg merge
3d 16h
Merged PRs (30d)
11

Description

`ArrowFlightJdbcArray.checkBoundaries` validates the caller-supplied index against `startOffset + valuesCount`:

```java
private void checkBoundaries(long index, int count) {
if (index < 0 || index + count > this.startOffset + this.valuesCount) {
throw new ArrayIndexOutOfBoundsException();
}
}
```

but `index` is relative to the start of the array; both call sites add `startOffset` to it only afterwards, e.g.

```java
checkBoundaries(index, count);
return getArrayNoBoundCheck(
this.dataVector, LargeMemoryUtil.checkedCastToInt(this.startOffset + index), count);
```

So the accepted range is too large by exactly `startOffset` elements, and `getArray(index, count)` / `getResultSet(index, count)` will read up to that far past the end of the row's slice.

`AbstractArrowFlightJdbcListVectorAccessor` builds these with the offsets of the list element being read, so any row of a list column that does not start at child offset 0 is affected. Reading within the element count the driver itself advertises then returns values belonging to other rows of the shared child vector, and past the child vector's `valueCount` it returns whatever is in allocated-but-unwritten memory.

Reproducer against an `IntVector` of 127 values, with an array covering elements 5..7:

```java
ArrowFlightJdbcArray array = new ArrowFlightJdbcArray(dataVector, 5, 3);
array.getArray(1, 3); // accepted; returns elements 6, 7, 8 — element 8 is outside the array
```

Every existing test constructs the array with `startOffset` 0, where the wrong bound happens to coincide with the correct one, which is why this is not currently caught.

Contributor guide

Open the contributing guide

Research direction

Start in ArrowFlightJdbcArray.checkBoundaries and inspect both getArray(index, count) and getResultSet(index, count) call sites. Add a regression test using a nonzero startOffset, such as the provided IntVector slice, and run the existing ArrowFlightJdbcArray tests; done means requests cannot read beyond the array slice.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
database
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.