[GitHub] [arrow] Yuhta commented on a change in pull request #8937: ARROW-10932: [C++] BinaryMemoTable::CopyOffsets access out-of-bound address when data is empty

[GitBox]

Yuhta commented on a change in pull request #8937:
URL: https://github.com/apache/arrow/pull/8937#discussion_r544534942



##########
File path: cpp/src/arrow/util/hashing.h
##########
@@ -691,7 +691,7 @@ class BinaryMemoTable : public MemoTable {
 
     const builder_offset_type* offsets = binary_builder_.offsets_data();
     const builder_offset_type delta =
-        start < binary_builder_.value_data_length() ? offsets[start] : 0;
+        start < binary_builder_.length() ? offsets[start] : 0;

Review comment:
       Depends on if you want to allow `start >= binary_builder_.length()`.  If 
it is allowed and the range is selected as 
![formula](https://render.githubusercontent.com/render/math?math=index%20\in%20(-\infty,%20length)%20\cap%20[start,%20%2b\infty)),
 it is ok to set `delta = 0`, and leave the only element in `out_data` as 
`binary_builder_.value_data_length()`.  If we set `delta = offsets[start]` in 
this case, we are going to copy some unauthorized memory to `out_data` and it's 
a potential vulnerability.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org