[arrow] branch main updated: GH-34831: [C++] Check REE child buffers are valid before other checks (#34833)

[wjones127]

This is an automated email from the ASF dual-hosted git repository.

wjones127 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow.git


The following commit(s) were added to refs/heads/main by this push:
     new 0e5af04bc7 GH-34831: [C++] Check REE child buffers are valid before 
other checks (#34833)
0e5af04bc7 is described below

commit 0e5af04bc776a852c414bf39f82a77886538e474
Author: Will Jones <willjones...@gmail.com>
AuthorDate: Fri Mar 31 15:12:44 2023 -0700

    GH-34831: [C++] Check REE child buffers are valid before other checks 
(#34833)
    
    ### Rationale for this change
    
    See issue. Invalid buffers can cause segfaults when 
`ValidateRunEndEncodedChildren` is called, so we need to validate the buffers 
first.
    
    ### What changes are included in this PR?
    
    Move up buffer checks.
    
    ### Are these changes tested?
    
    Checked against the fuzzer failure case that triggered the issue.
    
    ### Are there any user-facing changes?
    
    **This PR contains a "Critical Fix".**
    * Closes: #34831
    
    Authored-by: Will Jones <willjones...@gmail.com>
    Signed-off-by: Will Jones <willjones...@gmail.com>
---
 cpp/src/arrow/array/validate.cc | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cpp/src/arrow/array/validate.cc b/cpp/src/arrow/array/validate.cc
index 04effeba00..0f2bd45835 100644
--- a/cpp/src/arrow/array/validate.cc
+++ b/cpp/src/arrow/array/validate.cc
@@ -651,9 +651,14 @@ struct ValidateArrayImpl {
 
     const auto& run_ends_data = data.child_data[0];
     const auto& values_data = data.child_data[1];
-    RETURN_NOT_OK(ree_util::ValidateRunEndEncodedChildren(
-        type, data.length, run_ends_data, values_data, data.GetNullCount(), 
data.offset));
 
+    if (!run_ends_data) {
+      return Status::Invalid("Run ends array is null pointer");
+    }
+    if (!values_data) {
+      return Status::Invalid("Values array is null pointer");
+    }
+    // We must validate child array buffers are valid before making additional 
checks.
     const Status run_ends_valid = RecurseInto(*run_ends_data);
     if (!run_ends_valid.ok()) {
       return Status::Invalid("Run ends array invalid: ", 
run_ends_valid.message());
@@ -663,6 +668,9 @@ struct ValidateArrayImpl {
       return Status::Invalid("Values array invalid: ", values_valid.message());
     }
 
+    RETURN_NOT_OK(ree_util::ValidateRunEndEncodedChildren(
+        type, data.length, run_ends_data, values_data, data.GetNullCount(), 
data.offset));
+
     if (run_ends_data->length == 0) {
       return Status::OK();
     }