[C++][Gandiva] Out-of-bounds read in soundex_utf8 mappings lookup
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug
`soundex_utf8` in `cpp/src/gandiva/precompiled/string_ops.cc` looks up each soundex digit in a 26-entry `mappings[]` table (indices for A-Z), but it classifies characters and folds case with the locale-sensitive `isalpha`/`toupper`.
Under a non-C locale (for example `en_US.UTF-8` or an ISO-8859 locale), `isalpha` accepts bytes `0x80`-`0xFF` as letters and `toupper` leaves them past `'Z'`, so `mappings[toupper(byte) - 'A']` reads past the end of the 26-element table. This is reachable from SQL `soundex()` on untrusted string data.
Under AddressSanitizer this shows up as a global-buffer-overflow read on `mappings` for an input byte such as `0xAA` when the process locale classifies it as a letter.
### Component(s)
C++, Gandiva
Contributor guide
Assessment
This issue has not been assessed yet.