apache / apache/arrow

[C++][Feather] Avoid reading outside sliced bitmap buffers in V1 writer

Open
#50,762 1 comment 0 reactions 1 assignee Claimed by @tcmartin View on GitHub
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

## Describe the bug

The Feather V1 writer shifts bitmap bytes when serializing a sliced Boolean
array or validity bitmap. On the final output byte, the shift loop
unconditionally reads the next source byte even when the logical slice ends in
the current byte.

A valid `ArrayData` backed by an exact-sized `Buffer` therefore causes a
one-byte heap-buffer-overflow read. The adjacent bit is also folded into the
unused bits of the serialized bitmap byte.

## Component

C++ IPC / Feather V1 writer.

## Version

Reproduced on current `main` at
`35c5ffd12173284406e4a2c86405415444e596d7`.

## Minimal reproduction

```cpp
auto owner = std::make_unique(1);
owner[0] = 0x03;
auto values = std::make_shared(owner.get(), 1);

auto data = arrow::ArrayData::Make(arrow::boolean(), 1, {nullptr, values},
/*null_count=*/0, /*offset=*/1);
auto array = arrow::MakeArray(data);
auto table = arrow::Table::Make(
arrow::schema({arrow::field("flag", arrow::boolean())}),
{std::make_shared(array)});

ARROW_ASSIGN_OR_RAISE(auto sink, arrow::io::BufferOutputStream::Create());
auto properties = arrow::ipc::feather::WriteProperties::DefaultsV1();
ARROW_RETURN_NOT_OK(
arrow::ipc::feather::WriteTable(*table, sink.get(), properties));
```

Under ASan, the write deterministically reports a one-byte
heap-buffer-overflow read in `WritePaddedWithOffset` in
`cpp/src/arrow/ipc/feather.cc`.

The same harness with `offset = 0` completes without a sanitizer error.

## Expected behavior

The writer should read only the bitmap bytes required by the logical slice and
clear unused trailing bits in the serialized bitmap byte.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.