Copilot commented on code in PR #50297:
URL: https://github.com/apache/arrow/pull/50297#discussion_r3497188768
##########
cpp/src/arrow/compute/kernels/vector_select_k.cc:
##########
@@ -422,9 +421,8 @@ class ChunkedArraySelector : public TypeVisitor {
// so the heap must have been completely filled
DCHECK_EQ(heap.size(), output.non_null_like_range.size());
- for (uint64_t& reverse_out_iter :
- std::ranges::reverse_view(output.non_null_like_range)) {
- reverse_out_iter =
+ for (int64_t i = output.non_null_like_range.size() - 1; i >= 0; --i) {
+ output.non_null_like_range[i] =
heap.top().index + heap.top().offset; // heap-top has the next
element
heap.pop();
}
Review Comment:
Reverse-fill loop can underflow when `output.non_null_like_range` is empty
(e.g., k==0 or all selected values are null/NaN).
`output.non_null_like_range.size() - 1` is computed as `size_t`, so it wraps to
a huge value before being assigned to `int64_t`, leading to out-of-bounds
writes and/or an infinite loop.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
