dmitry-chirkov-dremio opened a new issue, #49470:
URL: https://github.com/apache/arrow/issues/49470
### Describe the bug, including details regarding any error messages,
version, and platform.
Two Gandiva functions crash when called with extreme integer values:
1. **`substring_index(VARCHAR, VARCHAR, INT)` crashes with `INT_MIN` count
parameter**
- Calling `substring_index("a.b.c", ".", INT_MIN)` causes SIGBUS crash
- Root cause: Uses `abs(cnt)` which triggers undefined behavior when `cnt
== INT_MIN` (abs(INT_MIN) overflows in 32-bit signed integers)
2. **`truncate(BIGINT, INT)` crashes with extreme scale values**
- Calling `truncate(12345, INT_MAX)` or `truncate(12345, INT_MIN)` causes
SIGSEGV
- Root cause: Passes extreme scale values directly to
`GetScaleMultiplier`, which only has array entries for scales 0-38, causing
out-of-bounds array access
### Expected behavior
Both functions should handle extreme integer values gracefully without
crashing:
- `substring_index` should safely compute absolute value of count parameter
- `truncate` should validate scale parameter before array access
### Actual behavior
- `substring_index`: SIGBUS crash due to integer overflow in `abs(INT_MIN)`
- `truncate`: SIGSEGV crash due to out-of-bounds array access
### How to reproduce
```cpp
// substring_index crash
gdv_fn_substring_index(ctx, "a.b.c", 5, ".", 1, INT_MIN, &out_len);
// truncate crash
truncate_int64_int32(12345, INT_MAX);
truncate_int64_int32(12345, INT_MIN);
### Component(s)
C++, Gandiva
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
