Arawoof06 opened a new pull request, #51006:
URL: https://github.com/apache/arrow/pull/51006

   ### Rationale for this change
   
   the posix branch of `UriFromAbsolutePath` passes `path.data()` from a 
`std::string_view` straight into `uriUnixFilenameToUriStringA`, which scans its 
argument as a nul-terminated c string. a `string_view` is not required to be 
nul-terminated, so a view backed by a larger buffer makes the vendored routine 
read past the end of the view, and because `out` is sized from `path.length()` 
a longer run also writes past `out`. the windows branch just above already 
sidesteps this by copying into a `std::string` first.
   
   ### What changes are included in this PR?
   
   copy the view into a `std::string` on the posix branch before the call and 
size the output from that copy, mirroring the windows branch.
   
   ### Are these changes tested?
   
   yes. `UriFromAbsolutePath.NonNulTerminatedView` passes a prefix view of a 
longer buffer; before the change the conversion consumed the trailing bytes and 
returned `file:///tmp/foo%20and%20more%20b...`, after it returns 
`file:///tmp/foo`. the existing `UriFromAbsolutePath.Basics` still passes.
   
   ### Are there any user-facing changes?
   
   no.
   
   **This PR contains a "Critical Fix".** it fixes a heap out-of-bounds read 
(and possible write) reachable through the public `UriFromAbsolutePath` entry 
point when the caller passes a view that is not nul-terminated.
   
   * GitHub Issue: #51005


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to