Skip to content

add arrow csr dst col name#19

Merged
adsharma merged 2 commits into
LadybugDB:mainfrom
aheev:add-arrow-csr-dst-col-name
May 28, 2026
Merged

add arrow csr dst col name#19
adsharma merged 2 commits into
LadybugDB:mainfrom
aheev:add-arrow-csr-dst-col-name

Conversation

@aheev
Copy link
Copy Markdown
Contributor

@aheev aheev commented May 28, 2026

No description provided.

@aheev
Copy link
Copy Markdown
Contributor Author

aheev commented May 28, 2026

failures are related to new changes in c_api

@adsharma
Copy link
Copy Markdown
Contributor

adsharma commented May 28, 2026

  • Medium, security/API surface: src_cpp/main.cpp:12 exports createArrowCSRTestData from the production native
    addon. That is test fixture code shipped in the runtime binary, returning unmanaged native pointer-like
    Externals. Even if it is not in the public .d.ts, it is still part of the native module surface and gives
    consumers a native allocation helper that only exists for tests. This should be behind a test-only build flag,
    moved into a separate test addon, or avoided.

  • Medium, DoS/memory-safety risk: src_js/connection.js:428 validates dstColName in CSR mode but does not validate indptrArraysPtr or numIndptrArrays. Native then uses Uint32Value() at src_cpp/node_connection.cpp:293 and src_cpp/node_connection.cpp:295. Values like -1 can wrap to a huge unsigned count, and TakeArrowArrays reserves/reads that many arrays from a pointer. Validate both counts as positive safe integers in JS and add native range/type checks too.

@adsharma adsharma merged commit da51dc5 into LadybugDB:main May 28, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants