apache / apache/arrow

[C++][Gandiva] Heap buffer overflow casting date64 to VARCHAR

Open
#50,539 0 comments 0 reactions 1 assignee Claimed by @Arawoof06 View on GitHub
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

`castVARCHAR`/`castVARBINARY` from `date64` size their output block with a hard-coded 10 (`YYYY-MM-DD`), but the copy that follows is bounded by the caller-supplied length instead of by what was allocated.

`arrow::internal::StringFormatter` emits more than 10 bytes in two cases: years outside 0-9999 need 11-12 bytes, and values it cannot represent go through `detail::FormatOutOfRange`, which produces up to 42 bytes, e.g. ``.

So `castVARCHAR(, 64)` on an out-of-range value writes 42 bytes into a 10-byte arena block and sets `out_len` to 42, corrupting whatever the execution context hands out next. A test that performs the cast and then allocates again from the same context reads back:

```

```

The float macro has the same structure with a 24-byte constant; its formatter is documented to use a 50-byte buffer, so the same mismatch exists there even though current Java-style output happens to stay under 24.

### Component(s)

C++ - Gandiva

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.