Skip to content

Out-of-bounds read for corrupt view offsets in BaseVariableWidthViewVector #1217

Description

@Arawoof06

Describe the bug

ViewVarCharVector/ViewVarBinaryVector store values longer than INLINE_SIZE (12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input.

BaseVariableWidthViewVector dereferences them verbatim in getData, getDataPointer, hashCode, copyFromNotNull and splitAndTransferViewBufferAndDataBuffer, e.g.

dataBuffers.get(bufferIndex).getBytes(dataOffset, result, 0, dataLength);

Nothing checks that bufferIndex is in range or that dataOffset + dataLength fits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throws IndexOutOfBoundsException, but with arrow.enable_unsafe_memory_access=true (commonly set in production) it reads arbitrary native heap into the returned value.

Component(s)

Java

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions