tcmartin opened a new pull request, #50763:
URL: https://github.com/apache/arrow/pull/50763
### Rationale for this change
The Feather V1 bitmap shift loop unconditionally read the byte after the
final
source byte. For an exact-sized sliced bitmap, this caused a one-byte
out-of-bounds read and copied data outside the logical slice into unused
bits of
the serialized bitmap.
Closes #50762.
### What changes are included in this PR?
- Keep bitmap length in bits while writing shifted Boolean and validity
bitmaps.
- Stop before reading a source byte that is not required by the logical
slice.
- Clear unused trailing bits in the serialized bitmap.
- Add an exact-sized sliced-Boolean regression test that checks the
serialized
byte and round-trip result.
### Are these changes tested?
Yes.
- Full `arrow-feather-test` suite under ASan/UBSan: 84 passed, 5 expected
skips.
- Standalone exact-sized-buffer reproducer under ASan/UBSan: offset-zero
control and offset-one trigger both complete cleanly after the fix.
### Are there any user-facing changes?
No public API changes. Feather V1 output no longer incorporates bits outside
a
logical bitmap slice.
**This PR contains a Critical Fix.** It prevents an out-of-bounds read and
incorrect data from being copied into serialized output when the documented
array-buffer contract is upheld.
### AI assistance
I used an AI coding assistant to help trace the writer, draft the
implementation
and regression test, and run the verification commands. I reviewed the
complete
diff, reproduced the original fault under ASan, verified the bit-boundary
logic, and ran the full Feather test suite. No maintainer was tagged or
pinged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
