Arawoof06 opened a new pull request, #50441: URL: https://github.com/apache/arrow/pull/50441
### Rationale for this change `set_error_for_date` formats the invalid-date/timestamp message with `snprintf(error, size, "%s%s", msg, input)`, but `input` is a Gandiva string passed as pointer plus `length` and is not NUL-terminated, so the `%s` conversion scans past the `length` bytes looking for a terminator and over-reads the values buffer (past its end for the last value). It is reached from `castDATE_utf8`/`castTIMESTAMP_utf8` on any invalid `CAST(str AS DATE/TIMESTAMP)` input. Switching to the bounded `%.*s` form with the explicit length keeps the read inside the string, matching every other error formatter in the precompiled sources. ### What changes are included in this PR? Use `%.*s` with `length` in `set_error_for_date`, which covers all of its call sites in both `castDATE_utf8` and `castTIMESTAMP_utf8`. ### Are these changes tested? Yes. Added `TestTime.TestCastDateInvalidUnterminated`, which feeds an invalid date held in an exactly-sized heap buffer with no trailing NUL so the over-read trips AddressSanitizer, and checks the error string is bounded to the input length. ### Are there any user-facing changes? No. **This PR contains a "Critical Fix".** It fixes a heap out-of-bounds read reachable from user-supplied CAST-to-date/timestamp input. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
