paleolimbot opened a new pull request, #289:
URL: https://github.com/apache/arrow-nanoarrow/pull/289

   Closes #287.
   
   The reported crash occurred because the internal 
`ArrowIpcDecoderVerifyHeader()` incorrectly interpreted the return value of 
`ArrowIpcDecoderCheckHeader()`. Because the header checker returned an error 
code sometimes even if it succeeded, we had been ignoring the error in 
`ArrowIpcDecoderVerifyHeader()` which resulted in issuing commands like 
`memcpy(dst, src, -8)`. I believe that's undefined behaviour, leading to the 
intermittent nature of the crash.
   
   In adding tests for this kind of error, I also made some improvements to 
error messages along the way.
   
   ```bash
   # docker run --rm -it ghcr.io/apache/arrow-nanoarrow:ubuntu
   # git clone https://github.com/apache/arrow-nanoarrow.git /arrow-nanoarrow
   # or
   # docker run --rm -it -v$(pwd):/arrow-nanoarrow 
ghcr.io/apache/arrow-nanoarrow:ubuntu
   
   cd /arrow-nanoarrow/extensions/nanoarrow_ipc
   mkdir build && cd build
   cmake .. -DNANOARROW_IPC_BUILD_APPS=ON
   
   curl 
https://gist.githubusercontent.com/amoeba/b64fc94ba5224bafcb3734bd261181d5/raw/af4c93da7ce6affba74a80e1ba94ed9573e91be8/test_arrow_data
 | \
       base64 -d > test_binary
   
   with_byte_removed() {
       BYTE_PLUS_ONE=$(($2 + 2))
       cat $1 | head -c $2
       cat $1 | tail -c "+$BYTE_PLUS_ONE"
   }
   
   cmake --build .
   
   echo "Errors:" > out.txt
   for i in {1..32951}; do
     echo "$i/32951"
     echo "$i/32951" >> out.txt
     with_byte_removed test_binary $i | ./dump_stream - 2>> out.txt
   done
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to