ORC-2192: [C++] Reject invalid string length in StringDirectColumnReader

[dongjoon-hyun]

What changes were proposed in this pull request?

This PR adds validation to StringDirectColumnReader::computeSize in the C++ reader so a negative or overflowing string length throws ParseError before any blob is allocated. Both callers (next and skip) are covered, and since buildReader routes all direct-encoded string-family types to this reader, the single guard protects BINARY/CHAR/STRING/VARCHAR/GEOMETRY/GEOGRAPHY.

Why are the changes needed?

The LENGTH stream is decoded as unsigned RLE, so a malformed file can encode a varint >= 2^63 that becomes a negative int64_t. Cast to size_t, this triggers a huge blob.resize() and an out-of-bounds pointer walk. This restores parity with the Java reader, which already guards this path in BytesColumnVectorUtil.commonReadByteArrays.

orc/java/core/src/java/org/apache/orc/impl/TreeReaderFactory.java

Lines 2087 to 2098 in 1ce1786

	if (totalLength < 0) {
	StringBuilder sb = new StringBuilder("totalLength:" + totalLength
	+ " is a negative number.");
	if (batchSize > 1) {
	sb.append(" The current batch size is ");
	sb.append(batchSize);
	sb.append(", you can reduce the value by '");
	sb.append(OrcConf.ROW_BATCH_SIZE.getAttribute());
	sb.append("'.");
	}
	throw new IOException(sb.toString());
	}

How was this patch tested?

Added TestColumnReader.testStringDirectNegativeLength, which feeds a crafted LENGTH stream decoding to INT64_MIN and asserts ParseError is thrown.

Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Fable 5