DecimalVector.setBigEndian writes oversized value before validating length
- 主要語言
- Java
- 星號
- 94
- 分支
- 152
- 平均合併
- 3 天 16 小時
- 30 天內合併 PR
- 11
描述
DecimalVector.setBigEndian(int, byte[]) and Decimal256Vector.setBigEndian(int, byte[]) validate the input length only after copying the bytes. On a little-endian platform the method byte-swaps the value into the fixed 16/32-byte slot with a loop of unchecked MemoryUtil.putByte writes:
```java
for (int byteIdx = 0; byteIdx < length; ++byteIdx) {
MemoryUtil.putByte(outAddress + byteIdx, value[length - 1 - byteIdx]);
}
...
throw new IllegalArgumentException("Invalid decimal value length. Valid length in [1 - 16], got " + length);
```
If value.length exceeds the type width, the loop writes past the slot into adjacent off-heap memory before the IllegalArgumentException is thrown. MemoryUtil.putByte does no bounds checking, so this corrupts memory in the default configuration. setBigEndianSafe(int, long, ArrowBuf, int) performs the same write with no length check at all.
Reproducer: write a value into slot 1, then call setBigEndian(0, new byte[24]) on a DecimalVector; slot 1 is left corrupted (the write spills 8 bytes into it) even though the call throws.
貢獻指南
研究方向
從 DecimalVector.setBigEndian 和 Decimal256Vector.setBigEndian 開始,然後比較 setBigEndianSafe;檢查固定寬度槽位和長度驗證是如何處理的。為非零槽位重現一個過大的輸入,並新增涵蓋測試,證明相鄰記憶體保持不變,同時無效長度仍會拋出例外。完成標準是三個入口點都會在寫入之前拒絕過大的值。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- java
- 領域
- data
- Issue 類型
- 缺陷
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 活躍度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 72/100