Arawoof06 opened a new issue, #50504:
URL: https://github.com/apache/arrow/issues/50504
The `gdv_fn_upper_utf8`, `gdv_fn_lower_utf8` and `gdv_fn_initcap_utf8` stubs
in `cpp/src/gandiva/gdv_string_function_stubs.cc` decode a multibyte glyph with
`arrow::util::UTF8Decode` without first checking that the whole glyph fits
inside `data_len`. When the input ends in a truncated multibyte sequence (for
example a final `0xC3` or `0xE0` lead byte), `UTF8Decode` walks continuation
bytes past `data[data_len]`.
The functions back the SQL `upper()`, `lower()` and `initcap()` scalar
functions, so the input comes straight from a string array value buffer. When
the value buffer is packed and exactly sized (no trailing NUL), the read lands
past the allocation.
ASAN on an exact-sized buffer:
```
heap-buffer-overflow READ of size 1 ... 0 bytes after 4-byte region
in arrow::util::UTF8Decode (utf8_internal.h:353)
in gdv_fn_upper_utf8 (gdv_string_function_stubs.cc:361)
```
### Component(s)
C++, Gandiva
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
