ArrowFlightJdbcArray.getArray(index, count) can read past the end of the array slice
- Lingua principale
- Java
- Stelle
- 94
- Fork
- 152
- Merge medio
- 3g 16h
- PR unite (30g)
- 11
Descrizione
`ArrowFlightJdbcArray.checkBoundaries` validates the caller-supplied index against `startOffset + valuesCount`:
```java
private void checkBoundaries(long index, int count) {
if (index < 0 || index + count > this.startOffset + this.valuesCount) {
throw new ArrayIndexOutOfBoundsException();
}
}
```
but `index` is relative to the start of the array; both call sites add `startOffset` to it only afterwards, e.g.
```java
checkBoundaries(index, count);
return getArrayNoBoundCheck(
this.dataVector, LargeMemoryUtil.checkedCastToInt(this.startOffset + index), count);
```
So the accepted range is too large by exactly `startOffset` elements, and `getArray(index, count)` / `getResultSet(index, count)` will read up to that far past the end of the row's slice.
`AbstractArrowFlightJdbcListVectorAccessor` builds these with the offsets of the list element being read, so any row of a list column that does not start at child offset 0 is affected. Reading within the element count the driver itself advertises then returns values belonging to other rows of the shared child vector, and past the child vector's `valueCount` it returns whatever is in allocated-but-unwritten memory.
Reproducer against an `IntVector` of 127 values, with an array covering elements 5..7:
```java
ArrowFlightJdbcArray array = new ArrowFlightJdbcArray(dataVector, 5, 3);
array.getArray(1, 3); // accepted; returns elements 6, 7, 8 — element 8 is outside the array
```
Every existing test constructs the array with `startOffset` 0, where the wrong bound happens to coincide with the correct one, which is why this is not currently caught.
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia in ArrowFlightJdbcArray.checkBoundaries e controlla entrambi i call site di getArray(index, count) e getResultSet(index, count). Aggiungi un test di regressione usando un startOffset diverso da zero, come lo slice di IntVector fornito, ed esegui i test ArrowFlightJdbcArray esistenti; il lavoro è completato quando le richieste non possono leggere oltre lo slice dell'array.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- java
- Ambito
- database
- Tipo di issue
- Bug
- Difficoltà
- 2/5
- Tempo stimato
- 1-3 ore
- Stato di attività
- Tranquilla
- Chiarezza
- Specificata chiaramente
- Idoneità per principianti
- 78/100