adriangb opened a new pull request, #11484: URL: https://github.com/apache/arrow-rs/pull/11484
# Which issue does this PR close? - Part of https://github.com/apache/arrow-rs/issues/11234. # Rationale for this change `ColumnChunkData::get_bytes` slices the column chunk data without a length check. If the data is shorter than the requested length, `Bytes::slice` panics. This PR returns an error instead. I did not find a way to cause the panic through the public API on `main`, so this is a defensive fix. The batch mode of the push decoder (https://github.com/apache/arrow-rs/pull/11238) gives the reader one page at a time, which makes a short read possible if the decoder has a bug. This PR is split out of that PR to make it smaller. # What changes are included in this PR? ```diff fn get_bytes(&self, start: u64, length: usize) -> Result<Bytes> { - Ok(self.get(start)?.slice(..length)) + let data = self.get(start)?; + if data.len() < length { + return Err(general_err!("... has {} bytes, expected {length}")); + } + Ok(data.slice(..length)) } ``` # Are these changes tested? Yes, with the new test `get_bytes_errors_on_short_data`. - **Before:** `panicked at bytes-1.12.1/src/bytes.rs:374:28: range end out of bounds: 6 <= 5` - **After:** `Internal Error: column chunk data at offset 105 has 5 bytes, expected 6` # Are there any user-facing changes? No. `ColumnChunkData` is `pub(crate)`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
