Arawoof06 opened a new pull request, #1218: URL: https://github.com/apache/arrow-java/pull/1218
## What's Changed Utf8View and BinaryView values longer than 12 bytes live in a separate data buffer, with the data-buffer index and offset stored inline in the view; when a vector is read from an IPC stream those fields come from untrusted input. BaseVariableWidthViewVector dereferenced them without checking that the index is present or that offset+length stays inside the data buffer, so a crafted view reads past the buffer (and returns arbitrary native heap when arrow.enable_unsafe_memory_access is set). Routed every out-of-line dereference (get, getDataPointer, hashCode, copyFrom, splitAndTransfer) through one getValidatedDataBuffer check so a bad view is rejected at the source rather than in each caller. Closes #1217. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
