[C++][Gandiva] Heap buffer overflow casting date64 to VARCHAR
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug, including details regarding any error messages, version, and platform.
`castVARCHAR`/`castVARBINARY` from `date64` size their output block with a hard-coded 10 (`YYYY-MM-DD`), but the copy that follows is bounded by the caller-supplied length instead of by what was allocated.
`arrow::internal::StringFormatter` emits more than 10 bytes in two cases: years outside 0-9999 need 11-12 bytes, and values it cannot represent go through `detail::FormatOutOfRange`, which produces up to 42 bytes, e.g. ``.
So `castVARCHAR(, 64)` on an out-of-range value writes 42 bytes into a 10-byte arena block and sets `out_len` to 42, corrupting whatever the execution context hands out next. A test that performs the cast and then allocates again from the same context reads back:
```
```
The float macro has the same structure with a 24-byte constant; its formatter is documented to use a 50-byte buffer, so the same mismatch exists there even though current Java-style output happens to stay under 24.
### Component(s)
C++ - Gandiva
Contributor guide
Assessment
This issue has not been assessed yet.