Rich-T-kid opened a new pull request, #11993: URL: https://github.com/apache/arrow-rs/pull/11993
# Which issue does this PR close? - Relates to #11174 (review discussion: https://github.com/apache/arrow-rs/pull/11174#issuecomment-6305286024) - Supersedes #11782, which @alamb originally started. This carries that work forward with the existing review feedback addressed. # Rationale for this change `arrow-rs` follows the [Rust Soundness Pledge](https://github.com/apache/arrow-rs/blob/main/arrow/README.md#safety): code must not be able to trigger undefined behavior using safe APIs. However, the specialized `InProgressArray` implementations added in #9755 have safe functions whose memory safety depends on their callers. A caller passing an out-of-range `offset`/`len`, or a filter longer than the source array, could read out of bounds through a safe API. This came up while reviewing #11174, where the `copy_rows` pattern was cited as precedent. This PR removes that precedent. # What changes are included in this PR? - Use checked slicing in the safe primitive and byte-view `copy_rows` implementations - Validate filter lengths before specialized primitive and byte-view copies - Make the remaining unchecked append helpers unsafe and document their invariants - Add regression coverage for indices, slices, and all-true filters longer than the source # Are these changes tested? - `cargo test -p arrow-select coalesce --lib` - `cargo clippy -p arrow-select --all-targets --all-features -- -D warnings` - Focused Miri coverage for the changed primitive and byte-view paths # Are there any significant user-facing changes? No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
