xiaobai0529 opened a new pull request, #54909: URL: https://github.com/apache/arrow/pull/54909
## Summary - Run latbuffers::Verifier over Feather V1 metadata before bs::GetCTable, so malformed metadata returns Status::Invalid instead of being dereferenced. - Add a regression test using the 36-byte input from GH-50229. ## Root cause \ReaderV1::Open\ passed attacker-controlled metadata directly to \ bs::GetCTable\, and \ReadSchema\ then accessed \metadata_->columns()\ before any validation. This caused an out-of-bounds read reported by ASan. Fixes #50229 ## Verification - \rrow-feather-test\: 84 passed, 2 skipped (the two skips are pre-existing platform-specific skip cases). - Focused regression test \TestFeatherReader.RejectsInvalidV1Metadata\: passed. - Built in WSL Ubuntu against Arrow commit \373d64c02cb23663b63c5853099fca43a46c39fc\. ## AI assistance I used an AI coding assistant for investigation and drafting this patch. I reviewed the final diff and the verifier API, and ran the tests above locally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
