bit2swaz opened a new pull request, #10647:
URL: https://github.com/apache/arrow-rs/pull/10647

   # Which issue does this PR close?
   
   - Closes #10575.
   
   # Rationale for this change
   
   `arrow_ipc::convert::fb_to_schema` is infallible and panics on schema 
messages that the flatbuffer verifier itself accepts. the first thing it does 
is `fb.fields().unwrap()`, and `fields` is optional in the flatbuffer schema, 
so a message with no fields aborts the process. `get_data_type` has the same 
problem deeper down: about 20 more `panic!`/`unimplemented!` and 30 `unwrap()` 
reachable from decoder input (unknown float precision, `Type NONE`, out of 
range enum tags, and so on).
   
   every reader path funnels through `fb_to_schema`, so there was no way to 
read Arrow IPC without exposing the process to an abort on untrusted input. it 
also reaches parquet (an untrusted `.parquet` whose footer carries the 
`ARROW:schema` key) and arrow-flight. `StreamReader::try_new` returns `Result`, 
so malformed input should be an `Err`, not a process abort.
   
   # What changes are included in this PR?
   
   - `get_data_type` (already `pub(crate)`) now returns `Result<DataType, 
ArrowError>`; every input reachable `unwrap`/`panic!`/`unimplemented!` is now a 
returned `ParseError`.
   - new `pub fn try_fb_to_schema` and a private fallible field conversion. the 
readers in arrow-ipc, the parquet `ARROW:schema` path, and arrow-flight are 
switched onto it.
   - `fb_to_schema` and the public `From<crate::Field>` impl keep their 
signatures for compatibility and delegate to the fallible path.
   
   # Are these changes tested?
   
   yes. a schema message with no fields, one with an unknown float precision, 
and one with `Type NONE` now return `Err` instead of aborting, asserted by new 
tests in `arrow-ipc`. the flatbuffer verifier accepts all three, so they 
exercise the exact gap. existing round trip tests still pass.
   
   # Are there any user-facing changes?
   
   no breaking changes. `try_fb_to_schema` is additive, and `fb_to_schema` 
still exists with the same signature.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to