wgtmac commented on code in PR #51239:
URL: https://github.com/apache/arrow/pull/51239#discussion_r3968279228
##########
cpp/src/parquet/schema.cc:
##########
@@ -572,22 +577,35 @@ std::unique_ptr<Node> Unflatten(const
format::SchemaElement* elements, int lengt
return PrimitiveNode::FromParquet(opaque_element);
} else {
// Group node (may have 0 children, but cannot have a type)
- NodeVector fields;
+ // Protect against denial-of-service through stack exhaustion when
parsing
+ // deeply nested schemas.
+ if (depth >= max_depth) {
+ std::stringstream ss;
+ ss << "Parquet schema too deeply nested, consider increasing schema
depth limit "
+ "(current limit is "
+ << max_depth << ")";
+ throw ParquetException(ss.str());
+ }
+ if (element.num_children < 0) {
+ throw ParquetException("Invalid Parquet schema: negative number of
children");
+ }
+ NodeVector fields(element.num_children);
Review Comment:
Just in case that someone fakes a parquet file with `element.num_children` =
INT32_MAX in the future :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
