Jefffrey opened a new issue, #11856: URL: https://github.com/apache/arrow-rs/issues/11856
### Describe the bug when slicing buffers here: https://github.com/apache/arrow-rs/blob/d03274a7f69d9ec18e2d74920f8b880dd0a722a0/arrow-ipc/src/reader.rs#L194-L214 - line 205, 210 we trust the input length. this may be invalid/corrupt, but `slice_with_length()` doesnt report failure so itll just panic. ### To Reproduce ```rust #[test] fn test_union_short_type_ids_buffer() { use crate::r#gen::Message::{RecordBatch, RecordBatchArgs}; let fields = UnionFields::from_fields([Field::new("child", DataType::Null, true)]); let schema = Arc::new(Schema::new(vec![Field::new( "union", DataType::Union(fields, UnionMode::Sparse), false, )])); let mut fbb = flatbuffers::FlatBufferBuilder::new(); let nodes = fbb.create_vector(&[FieldNode::new(2, 0), FieldNode::new(2, 2)]); // All buffer ranges fit in the body. Only the union length is inconsistent: // sparse has one type id for two rows let buffers = fbb.create_vector(&[crate::Buffer::new(0, 1)]); let batch = RecordBatch::create( &mut fbb, &RecordBatchArgs { length: 2, nodes: Some(nodes), buffers: Some(buffers), ..Default::default() }, ); fbb.finish_minimal(batch); let batch = flatbuffers::root::<RecordBatch>(fbb.finished_data()).unwrap(); read_record_batch( &Buffer::from(vec![0u8; 16]), batch, schema, &HashMap::new(), None, &MetadataVersion::V5, ) .expect_err("a short union type-ids buffer should return an error"); } ``` - this test case was generated by codex output ```sh ---- reader::tests::test_union_short_type_ids_buffer stdout ---- thread 'reader::tests::test_union_short_type_ids_buffer' (1224657) panicked at arrow-buffer/src/buffer/immutable.rs:299:9: the offset of the new Buffer cannot exceed the existing length: slice offset=0 length=2 selflen=1 note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: reader::tests::test_union_short_type_ids_buffer test result: FAILED. 141 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s ``` ### Expected behavior fix so we report error instead of panicking ### Additional context Reported by Adam Korczynski from ADA Logics, identified by Anthropic -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
