fallintoplace opened a new pull request, #1063: URL: https://github.com/apache/arrow-go/pull/1063
## What changed Validate the complete Variant metadata offset table before allocating the key slice or reading offsets. The parser now also rejects a nonzero initial offset, decreasing offsets, and string offsets beyond the input. ## Why The previous size check omitted the final offset entry. Truncated input could therefore reach an out-of-bounds slice, while decreasing offsets could underflow during key-size calculation. A large untrusted dictionary count was also used to allocate before checking whether the offset table could fit in the input. Malformed metadata now consistently returns an error wrapping `ErrInvalidMetadata`. ## Testing - `go test ./parquet/variant` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
