[C++] STL allocator doesn't check for multiplication overflow
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
The MemoryPool-backed STL allocator defined in `arrow/stl.h` has the following code:
```c++
Status s = pool_->Allocate(n * sizeof(T), &data);
```
but `n * sizeof(T)` might silently overflow and lead to an incorrect allocation size.
**Reporter**: [Antoine Pitrou](https://issues.apache.org/jira/browse/ARROW-15615) / @pitrou
**Note**: *This issue was originally created as [ARROW-15615](https://issues.apache.org/jira/browse/ARROW-15615). Please see the [migration documentation](https://github.com/apache/arrow/issues/14542) for further details.*
Contributor guide
Research direction
Start in arrow/stl.h at the MemoryPool-backed STL allocator and inspect how the allocation size is calculated before pool_->Allocate is called. Confirm that an oversized element count cannot wrap the requested byte size, then verify the allocator’s existing tests cover the corrected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100