ShivanshhhG opened a new pull request, #55401: URL: https://github.com/apache/arrow/pull/55401
### Rationale for this change In `ipc::ReadMessage(offset, metadata_length, body_length, file)` and `ipc::ReadMessageAsync`, `body_length` is added to `metadata_length` to issue a single IO read for the entire message buffer. However, `body_length` was not validated before issuing the read: 1. Negative `body_length` values caused `ReadAt` / `ReadAsync` to read fewer bytes than `metadata_length`, but `SliceBuffer(metadata, 0, metadata_length)` still sliced using the expected length, resulting in out-of-bounds reads during decoding. 2. Extremely large `body_length` values could overflow 64-bit signed integer addition (`metadata_length + body_length`). ### What changes are included in this PR? - Validates that `body_length >= 0` in `ReadMessageInternal` (when `body_length` is provided) and `ReadMessageAsync`. - Uses `internal::AddWithOverflow` to guard against arithmetic overflow when adding `metadata_length + body_length`. - Returns `Status::Invalid` if validation fails. - Adds regression unit tests in `cpp/src/arrow/ipc/read_write_test.cc` verifying invalid and overflowing `body_length` are rejected in both synchronous and asynchronous overloads. ### Are these changes tested? Yes, covered by unit tests in `cpp/src/arrow/ipc/read_write_test.cc` (`TestReadMessage.ReadBodyWithInvalidLength`). ### Are there any user-facing changes? Direct calls to `ipc::ReadMessage` and `ipc::ReadMessageAsync` with negative or overflowing `body_length` now return `Status::Invalid` instead of proceeding with invalid buffer reads. * GitHub Issue: #55400 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
