apache / apache/arrow-java

DecimalVector.setBigEndian writes oversized value before validating length

Open
#1,246 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
94
Forks
152
Avg merge
3d 16h
Merged PRs (30d)
11

Description

DecimalVector.setBigEndian(int, byte[]) and Decimal256Vector.setBigEndian(int, byte[]) validate the input length only after copying the bytes. On a little-endian platform the method byte-swaps the value into the fixed 16/32-byte slot with a loop of unchecked MemoryUtil.putByte writes:

```java
for (int byteIdx = 0; byteIdx < length; ++byteIdx) {
MemoryUtil.putByte(outAddress + byteIdx, value[length - 1 - byteIdx]);
}
...
throw new IllegalArgumentException("Invalid decimal value length. Valid length in [1 - 16], got " + length);
```

If value.length exceeds the type width, the loop writes past the slot into adjacent off-heap memory before the IllegalArgumentException is thrown. MemoryUtil.putByte does no bounds checking, so this corrupts memory in the default configuration. setBigEndianSafe(int, long, ArrowBuf, int) performs the same write with no length check at all.

Reproducer: write a value into slot 1, then call setBigEndian(0, new byte[24]) on a DecimalVector; slot 1 is left corrupted (the write spills 8 bytes into it) even though the call throws.

Contributor guide

Open the contributing guide

Research direction

Start at DecimalVector.setBigEndian and Decimal256Vector.setBigEndian, then compare setBigEndianSafe; inspect how fixed-width slots and length validation are handled. Reproduce an oversized input for a nonzero slot and add coverage showing adjacent memory is unchanged while invalid lengths still throw. Done means all three entry points reject oversized values before writing.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
data
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.