[C++][Gandiva] Out-of-bounds read in upper/lower/initcap on truncated trailing UTF-8
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
The `gdv_fn_upper_utf8`, `gdv_fn_lower_utf8` and `gdv_fn_initcap_utf8` stubs in `cpp/src/gandiva/gdv_string_function_stubs.cc` decode a multibyte glyph with `arrow::util::UTF8Decode` without first checking that the whole glyph fits inside `data_len`. When the input ends in a truncated multibyte sequence (for example a final `0xC3` or `0xE0` lead byte), `UTF8Decode` walks continuation bytes past `data[data_len]`.
The functions back the SQL `upper()`, `lower()` and `initcap()` scalar functions, so the input comes straight from a string array value buffer. When the value buffer is packed and exactly sized (no trailing NUL), the read lands past the allocation.
ASAN on an exact-sized buffer:
```
heap-buffer-overflow READ of size 1 ... 0 bytes after 4-byte region
in arrow::util::UTF8Decode (utf8_internal.h:353)
in gdv_fn_upper_utf8 (gdv_string_function_stubs.cc:361)
```
### Component(s)
C++, Gandiva
Contributor guide
Assessment
This issue has not been assessed yet.