geoHeil opened a new issue, #12158: URL: https://github.com/apache/arrow-rs/issues/12158
## Describe the bug `arrow-ipc` can abort while decoding a malformed record batch whose metadata contains leftover `variadicBufferCounts` entries. `RecordBatchDecoder::read_record_batch` asserts that the queue is empty after decoding the schema, but peer-controlled metadata can leave entries unconsumed. With a release profile that aborts on panic, this terminates the process instead of returning a decoding error. The assertion is present in both the projection and non-projection paths. In the published `arrow-ipc` 59.2.0 source, the non-projection assertion is at `src/reader.rs:671`: ```text assert!(variadic_counts.is_empty()); ``` ## Reproduction A libFuzzer run against a Flight IPC decoding harness found the following retained 410-byte crash input. The harness parses length-delimited `FlightData` frames, replaces the first frame descriptor with a valid descriptor, and passes the frames to the IPC decoder. The malformed peer metadata leaves `variadicBufferCounts` non-empty after the schema fields are decoded. The input is base64-encoded: ```text fhJ8EAAAAAAACgAMAAoACQAEAAoAAAAQAAAAAAEEAAgACAAAAAQACAAAAAQAAAABAAAAFAAAABAAFAAQAAAADwAEAAAACAAQAAAAGAAAACAAAAAAAAACHAAAAAgADAAEAAsACAAAAEAAAAAAAAAAAAAAAAUAAAB2YWx1ZQAAAJcCEpABEAAAAAwAFAASABEABAAIAAwAAAAcAAAAgAAAAAAAAAAAAwQAOgAcABAADAAIAAQADAAAAFgAAAAsAAAAEAAAAAMAAAAAAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAgAAAAAAAAAAQABAAEAAAAwj6AAf///////wD//wD/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wEAAAAAAAAAAgAAADAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG0AAAAAAAAAAAAAAAA= ``` SHA-256 of the decoded input: ```text d4430ef4e2faa638963144d415f8e22f1391c07c3350523a03b077e6433e2301 ``` ## Expected behavior Malformed or inconsistent variadic buffer metadata should return an `ArrowError` (for example, an IPC error). Decoding untrusted Flight IPC data should not panic or abort the process. ## Proposed fix After decoding the projected and non-projected schema fields, check for leftover variadic buffer counts and return a typed IPC error when any remain, in both branches of `RecordBatchDecoder::read_record_batch`. The crash was observed with `arrow-ipc` 59.2.0. No `cargo fuzz tmin` minimization was run; the input above is the retained crash artifact from the fuzz run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
