Describe the bug
ViewVarCharVector/ViewVarBinaryVector store values longer than INLINE_SIZE (12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input.
BaseVariableWidthViewVector dereferences them verbatim in getData, getDataPointer, hashCode, copyFromNotNull and splitAndTransferViewBufferAndDataBuffer, e.g.
dataBuffers.get(bufferIndex).getBytes(dataOffset, result, 0, dataLength);
Nothing checks that bufferIndex is in range or that dataOffset + dataLength fits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throws IndexOutOfBoundsException, but with arrow.enable_unsafe_memory_access=true (commonly set in production) it reads arbitrary native heap into the returned value.
Component(s)
Java
Describe the bug
ViewVarCharVector/ViewVarBinaryVectorstore values longer thanINLINE_SIZE(12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input.BaseVariableWidthViewVectordereferences them verbatim ingetData,getDataPointer,hashCode,copyFromNotNullandsplitAndTransferViewBufferAndDataBuffer, e.g.Nothing checks that
bufferIndexis in range or thatdataOffset + dataLengthfits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throwsIndexOutOfBoundsException, but witharrow.enable_unsafe_memory_access=true(commonly set in production) it reads arbitrary native heap into the returned value.Component(s)
Java