fix(array): validate binary_view and string_view payloads

[fallintoplace]

Summary

• add BinaryView and StringView validators
• validate view header ranges, referenced buffers, prefixes, and inline padding during ValidateFull
• validate UTF-8 for StringView payloads and add regressions for malformed headers

Why

BinaryView and StringView accessors currently trust header metadata directly. Malformed view headers can pass validation today even when they reference missing data or carry invalid payload metadata.

Validation

• go test ./arrow/array
• go test ./arrow/compute/...

[zeroshade]

Thanks for this — the per-view invariants are a faithful, complete port of Arrow C++ ValidateBinaryView (negative size, inline padding-zero, buffer index/offset bounds, prefix match, and UTF-8 for StringView), and the cheap Validate / full ValidateFull split respects the O(1) vs O(n) contract. Tests pass and go vet is clean.

Requesting changes on two items:

1. Blocking: ValidateFull panics with a nil-pointer dereference on any empty (length-0) BinaryView/StringView, including the standard builder output. validateViewValues unconditionally dereferences buffers[1], which is nil for empty arrays (Validate returns early and never touches it). This regressed in the "tighten view validation helpers" commit. Repro + one-line guard inline.
2. CI lint: gofmt fails on the inline-padding slice expression. Suggestion inline.

Non-blocking: a couple of tests worth adding (inline on the test file) — an empty-array case would have caught #1, and the out-of-line path is currently under-tested.

Details inline.

[zeroshade]

Blocking: ValidateFull panics on empty (length-0) view arrays.

Validate() (via validateViewLayout) returns early when length == 0 and never dereferences buffers[1], but for an empty view array buffers[1] is nil, so this hoisted data.buffers[1].Bytes() panics.

Reproduced on the standard builder output (and on hand-built data):

array.ValidateFull(array.NewBinaryViewBuilder(mem).NewBinaryViewArray()) // panic: invalid memory address or nil pointer dereference
array.ValidateFull(array.NewStringViewBuilder(mem).NewStringViewArray()) // panic

This regressed in the "tighten view validation helpers" commit — patch 1 only touched buffers[1] inside the loop, so empty arrays were safe. It also undercuts the helper's intent: validation should report malformed data, not crash on a valid empty array.

Suggested change

	rawViews := data.buffers[1].Bytes()
	if data.length == 0 {
	return nil
	}
	rawViews := data.buffers[1].Bytes()

[zeroshade]

gofmt fails here (CI lint) — it wants spaces around : when the slice bounds are expressions:

Suggested change

	for _, b := range raw[4+view.Len():arrow.ViewHeaderSizeBytes] {
	for _, b := range raw[4+view.Len() : arrow.ViewHeaderSizeBytes] {

[zeroshade]

Nice regression set. A few high-value cases are missing — the first would have caught the empty-array panic in validateViewValues:

• Empty (length-0) array via array.ValidateFull (currently panics).
• Drive the public array.Validate / array.ValidateFull entrypoints, not just the methods directly, so framework dispatch + layout checks are covered.
• An array with offset > 0 to lock in the (data.offset+i)*ViewHeaderSizeBytes indexing.
• Out-of-line happy path plus untested failure modes: prefix mismatch, negative / out-of-range buffer offset, and offset+size > buffer length.

[zeroshade]

Thanks for this — the per-view invariants are a faithful, complete port of Arrow C++ ValidateBinaryView (negative size, inline padding-zero, buffer index/offset bounds, prefix match, and UTF-8 for StringView), and the cheap Validate / full ValidateFull split respects the O(1) vs O(n) contract. Tests pass and go vet is clean.

Requesting changes on two items:

1. Blocking: ValidateFull panics with a nil-pointer dereference on any empty (length-0) BinaryView/StringView, including the standard builder output. validateViewValues unconditionally dereferences buffers[1], which is nil for empty arrays (Validate returns early and never touches it). This regressed in the "tighten view validation helpers" commit. Repro + one-line guard inline.
2. CI lint: gofmt fails on the inline-padding slice expression. Suggestion inline.

Non-blocking: a couple of tests worth adding (inline on the test file) — an empty-array case would have caught #1, and the out-of-line path is currently under-tested.

Details inline.

Duplicate of the review directly above (accidental double-submit); see that one for the actual feedback.

[zeroshade]

Issues fixed, just needs to have the merge conflicts resolved