apache / apache/arrow

[C++][Gandiva] Out-of-bounds read in upper/lower/initcap on truncated trailing UTF-8

Open
#50,504 0 comments 0 reactions 1 assignee Claimed by @Arawoof06 View on GitHub
Component: C++ Component: Gandiva
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

The `gdv_fn_upper_utf8`, `gdv_fn_lower_utf8` and `gdv_fn_initcap_utf8` stubs in `cpp/src/gandiva/gdv_string_function_stubs.cc` decode a multibyte glyph with `arrow::util::UTF8Decode` without first checking that the whole glyph fits inside `data_len`. When the input ends in a truncated multibyte sequence (for example a final `0xC3` or `0xE0` lead byte), `UTF8Decode` walks continuation bytes past `data[data_len]`.

The functions back the SQL `upper()`, `lower()` and `initcap()` scalar functions, so the input comes straight from a string array value buffer. When the value buffer is packed and exactly sized (no trailing NUL), the read lands past the allocation.

ASAN on an exact-sized buffer:

```
heap-buffer-overflow READ of size 1 ... 0 bytes after 4-byte region
in arrow::util::UTF8Decode (utf8_internal.h:353)
in gdv_fn_upper_utf8 (gdv_string_function_stubs.cc:361)
```

### Component(s)

C++, Gandiva

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.