fallintoplace opened a new issue, #948: URL: https://github.com/apache/arrow-go/issues/948
### Describe the bug The IPC stream and file readers use several serialized length and offset fields before fully validating them. In `arrow/ipc/message.go`, the stream reader converts the unsigned metadata prefix to `int32` and uses it as an allocation size. Values above `math.MaxInt32` become negative, while large positive values can request very large allocations. The FlatBuffer body length is also converted to `int` and passed to `Buffer.Resize` without checking that it is nonnegative, representable, or within a configured limit. The file reader has the same class of problem around footer blocks. Alignment is checked, but negative aligned offsets and lengths still pass. `mappedFileBlock.section` slices using footer-controlled offset, metadata length, and body length before checking their combined range. The ordinary block reader also assumes enough metadata exists before reading the prefix. Finally, `RecordBatchAt` accepts `i == NumRecords()` because its bounds check uses `>` instead of `>=`. Malformed or truncated IPC input should return a contextual error before allocating, parsing, or slicing. ### Suggested scope - Validate metadata and body lengths before integer conversion or allocation. - Reject negative block offsets and lengths. - Use checked addition for `offset + metadata + body`. - Require sufficient bytes for continuation prefixes. - Share block validation between mapped and ordinary readers. - Fix the `RecordBatchAt` upper-bound check. - Decide whether reader options should expose metadata and body size limits, with safe defaults. ### Regression coverage - Metadata prefixes `0x7fffffff`, `0x80000000`, and `0xffffffff`. - Metadata shorter than the required FlatBuffer or continuation prefix. - Negative and overflowing file block fields. - A mapped block ending one byte beyond the input. - Negative or oversized body lengths. - `RecordBatchAt(NumRecords())`. Observed on current `main` at `750586710988bc18f7af64fd29af8e0acdb252ac`. ### Component(s) Other -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
