This is an automated email from the ASF dual-hosted git repository.
mdeepak pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/orc.git
The following commit(s) were added to refs/heads/master by this push:
new 0d13ddb ORC-496: [C++] Fix integer overflow in skip of column reader
(#389)
0d13ddb is described below
commit 0d13ddb28894ce861350c6239606ce6b0a34bb91
Author: Gang Wu <[email protected]>
AuthorDate: Tue Apr 30 11:08:41 2019 -0700
ORC-496: [C++] Fix integer overflow in skip of column reader (#389)
skip() function is the StringDirectColumnReader and DoubleColumnReader
use size_t to compute total size to skip; however, the value is casted
to int when calling underlying input stream.
---
c++/src/ColumnReader.cc | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/c++/src/ColumnReader.cc b/c++/src/ColumnReader.cc
index 01b9925..4e36f4d 100644
--- a/c++/src/ColumnReader.cc
+++ b/c++/src/ColumnReader.cc
@@ -417,8 +417,14 @@ namespace orc {
bytesPerValue * numValues) {
bufferPointer += bytesPerValue * numValues;
} else {
- inputStream->Skip(static_cast<int>(bytesPerValue * numValues -
- static_cast<size_t>(bufferEnd - bufferPointer)));
+ size_t sizeToSkip = bytesPerValue * numValues -
+ static_cast<size_t>(bufferEnd - bufferPointer);
+ const size_t cap = static_cast<size_t>(std::numeric_limits<int>::max());
+ while (sizeToSkip != 0) {
+ size_t step = sizeToSkip > cap ? cap : sizeToSkip;
+ inputStream->Skip(static_cast<int>(step));
+ sizeToSkip -= step;
+ }
bufferEnd = nullptr;
bufferPointer = nullptr;
}
@@ -667,7 +673,12 @@ namespace orc {
} else {
// move the stream forward after accounting for the buffered bytes
totalBytes -= lastBufferLength;
- blobStream->Skip(static_cast<int>(totalBytes));
+ const size_t cap = static_cast<size_t>(std::numeric_limits<int>::max());
+ while (totalBytes != 0) {
+ size_t step = totalBytes > cap ? cap : totalBytes;
+ blobStream->Skip(static_cast<int>(step));
+ totalBytes -= step;
+ }
lastBufferLength = 0;
lastBuffer = nullptr;
}