Nayana-Naik73 opened a new pull request, #55268: URL: https://github.com/apache/arrow/pull/55268
### Rationale for this change `ValidateArrayImpl::Visit(const FixedSizeListType&)` requires the child values array to hold `length * list_size` elements, but `FixedSizeListArray::value_offset(i)` and the kernels address the child at `(offset + i) * list_size`. A fixed_size_list array with a non-zero offset and a child of exactly `length * list_size` elements passes `Validate()` and `ValidateFull()` and then reads up to `offset * list_size` elements past the end of the child. With `offset = 100` over a 4-element int32 child, `ValidateFull()` returns OK and reading the first value is an ASan heap-buffer-overflow. Arrays sliced by Arrow itself always satisfy the stronger bound, so this only matters for externally supplied `ArrayData`, e.g. an `ArrowArray` imported through the C Data Interface, where the offset comes from the producer and `ValidateFull()` is the check consumers rely on. ### What changes are included in this PR? The expected values length is computed from `length + offset`, the same bound the struct and sparse union checks already use. `ValidateLayout` has already rejected an overflowing `length + offset` by this point. `TestArrayImport.ListWithOffset` had two fixed_size_list fixtures whose child length (9) was shorter than what the expected values read (12 elements). They only passed because the backing test buffer is 16 bytes. The child length is corrected to 12 and the expected values are unchanged. ### Are these changes tested? Yes. `TestFixedSizeListArray.NotEnoughValues` now covers an offset that fits and one that does not, and it fails without the fix. arrow-array-test, arrow-c-bridge-test and the rest of the C++ test suite (compute, IPC, Parquet, dataset) pass locally in an ASan debug build. ### Are there any user-facing changes? Fixed-size list arrays whose child is too short for their offset are now rejected by `Validate()`/`ValidateFull()`. **This PR contains a "Critical Fix".** `ValidateFull()` accepted fixed_size_list arrays that lead to out-of-bounds reads of the child array. ### Was AI used for this PR? **PR code and description written by:** - [X] Human - [x] AI **Reviewed before submission by:** - [x] Human - [ ] AI - [ ] Not reviewed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
