bit2swaz opened a new pull request, #10647: URL: https://github.com/apache/arrow-rs/pull/10647
# Which issue does this PR close? - Closes #10575. # Rationale for this change `arrow_ipc::convert::fb_to_schema` is infallible and panics on schema messages that the flatbuffer verifier itself accepts. the first thing it does is `fb.fields().unwrap()`, and `fields` is optional in the flatbuffer schema, so a message with no fields aborts the process. `get_data_type` has the same problem deeper down: about 20 more `panic!`/`unimplemented!` and 30 `unwrap()` reachable from decoder input (unknown float precision, `Type NONE`, out of range enum tags, and so on). every reader path funnels through `fb_to_schema`, so there was no way to read Arrow IPC without exposing the process to an abort on untrusted input. it also reaches parquet (an untrusted `.parquet` whose footer carries the `ARROW:schema` key) and arrow-flight. `StreamReader::try_new` returns `Result`, so malformed input should be an `Err`, not a process abort. # What changes are included in this PR? - `get_data_type` (already `pub(crate)`) now returns `Result<DataType, ArrowError>`; every input reachable `unwrap`/`panic!`/`unimplemented!` is now a returned `ParseError`. - new `pub fn try_fb_to_schema` and a private fallible field conversion. the readers in arrow-ipc, the parquet `ARROW:schema` path, and arrow-flight are switched onto it. - `fb_to_schema` and the public `From<crate::Field>` impl keep their signatures for compatibility and delegate to the fallible path. # Are these changes tested? yes. a schema message with no fields, one with an unknown float precision, and one with `Type NONE` now return `Err` instead of aborting, asserted by new tests in `arrow-ipc`. the flatbuffer verifier accepts all three, so they exercise the exact gap. existing round trip tests still pass. # Are there any user-facing changes? no breaking changes. `try_fb_to_schema` is additive, and `fb_to_schema` still exists with the same signature. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
