Skip to content

[57_maintenance] Prevent ArrayData validation length overflow (#9816) - #9925

Merged
alamb merged 1 commit into
apache:57_maintenancefrom
alamb:alamb/backport_9816_57
May 6, 2026
Merged

[57_maintenance] Prevent ArrayData validation length overflow (#9816)#9925
alamb merged 1 commit into
apache:57_maintenancefrom
alamb:alamb/backport_9816_57

Conversation

@alamb

@alamb alamb commented May 5, 2026

Copy link
Copy Markdown
Contributor

# Which issue does this PR close?

- None.

# Rationale for this change

`ArrayData` validation used unchecked `usize` arithmetic when combining
array lengths and offsets. In optimized builds, very large lengths could
wrap these calculations and allow invalid `ArrayData` metadata to pass
validation.

# What changes are included in this PR?

This adds checked arithmetic for length plus offset calculations in
`ArrayData` validation, including offset-buffer validation and related
typed-buffer sizing paths.

# Are these changes tested?

Yes. This adds regression coverage for overflowing offset-buffer and
typed-buffer length calculations.

Validated with:

```bash
cargo test -p arrow-data overflow --release
```

# Are there any user-facing changes?

Invalid `ArrayData` whose length and offset cannot be represented
without overflow now returns an validation error consistently across
build modes. There are no API changes.
@github-actions github-actions Bot added the arrow Changes to the arrow crate label May 5, 2026
@alamb
alamb marked this pull request as ready for review May 5, 2026 20:31

@etseidl etseidl left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good as well

@alamb
alamb merged commit 33d9479 into apache:57_maintenance May 6, 2026
26 checks passed
@alamb
alamb deleted the alamb/backport_9816_57 branch May 6, 2026 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

arrow Changes to the arrow crate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants