apache / apache/arrow

[C++][Gandiva] Out-of-bounds read in soundex_utf8 mappings lookup

Open
#50,893 0 comments 0 reactions 1 assignee Claimed by @Arawoof06 View on GitHub
Component: C++ Component: Gandiva
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug

`soundex_utf8` in `cpp/src/gandiva/precompiled/string_ops.cc` looks up each soundex digit in a 26-entry `mappings[]` table (indices for A-Z), but it classifies characters and folds case with the locale-sensitive `isalpha`/`toupper`.

Under a non-C locale (for example `en_US.UTF-8` or an ISO-8859 locale), `isalpha` accepts bytes `0x80`-`0xFF` as letters and `toupper` leaves them past `'Z'`, so `mappings[toupper(byte) - 'A']` reads past the end of the 26-element table. This is reachable from SQL `soundex()` on untrusted string data.

Under AddressSanitizer this shows up as a global-buffer-overflow read on `mappings` for an input byte such as `0xAA` when the process locale classifies it as a letter.

### Component(s)

C++, Gandiva

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.