Skip to content

Accessing values from imported 'C data interface' array can result in out of bounds reads #709

@pepijnve

Description

@pepijnve

Describe the bug, including details regarding any error messages, version, and platform.

Apache Datafusion creates variable-sized binary arrays whose first offset value into the value buffer is not 0. When importing these into the Java implementation via the C data interface, BufferImportTypeVisitor calculates the size of the value buffer as offsets[<last>] - offsets[0]. In the case where offsets[0] != 0 this results in a too small value for the capacity of the value buffer. When attempting to access the last value in the value buffer, this results in an out of bounds exception

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions