apache / apache/arrow

[C++] STL allocator doesn't check for multiplication overflow

Open
#31,076 0 comments 0 reactions 0 assignees View on GitHub
Component: C++ Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

The MemoryPool-backed STL allocator defined in `arrow/stl.h` has the following code:
```c++

Status s = pool_->Allocate(n * sizeof(T), &data);
```

but `n * sizeof(T)` might silently overflow and lead to an incorrect allocation size.

**Reporter**: [Antoine Pitrou](https://issues.apache.org/jira/browse/ARROW-15615) / @pitrou

**Note**: *This issue was originally created as [ARROW-15615](https://issues.apache.org/jira/browse/ARROW-15615). Please see the [migration documentation](https://github.com/apache/arrow/issues/14542) for further details.*

Contributor guide

Open the contributing guide

Research direction

Start in arrow/stl.h at the MemoryPool-backed STL allocator and inspect how the allocation size is calculated before pool_->Allocate is called. Confirm that an oversized element count cannot wrap the requested byte size, then verify the allocator’s existing tests cover the corrected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.