apache / apache/arrow

[C++][Parquet] Uncontrolled Memory Allocation (OOM) in Parquet Delta decoders

Open
#49,955 0 comments 0 reactions 1 assignee Claimed by @sivaadityacoder View on GitHub
Component: C++ Component: Parquet
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

An uncontrolled memory allocation vulnerability exists in the Parquet `DeltaByteArrayDecoder`, `DeltaLengthByteArrayDecoder`, and `DeltaBitPackDecoder`.

Currently, these decoders trust the `num_values` (and implicitly the `total_value_count_`) provided by the Parquet data page header. The decoders eagerly allocate memory arrays sized proportionally to this unvalidated count (`e.g. buffered_prefix_length_->Resize(num_prefix * sizeof(int32_t))`).

An attacker can exploit this by crafting a tiny Parquet file (e.g., ~300 bytes) with a maliciously forged `num_values` (e.g., `1,000,000,000`). When this file is opened, Arrow attempts an immediate massive allocation (e.g., 4 GB), resulting in a `std::bad_alloc` and an immediate Denial of Service (OOM) crash.

*(Note: This vulnerability was originally submitted to the Huntr bug bounty platform (Reference ID: 7814255d-e945-427f-ab84-6eddc3a35a37), and is being filed here at the recommendation of the ASF Security Team and Andrew Lamb).*

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.