tcmartin opened a new issue, #50762:
URL: https://github.com/apache/arrow/issues/50762
## Describe the bug
The Feather V1 writer shifts bitmap bytes when serializing a sliced Boolean
array or validity bitmap. On the final output byte, the shift loop
unconditionally reads the next source byte even when the logical slice ends
in
the current byte.
A valid `ArrayData` backed by an exact-sized `Buffer` therefore causes a
one-byte heap-buffer-overflow read. The adjacent bit is also folded into the
unused bits of the serialized bitmap byte.
## Component
C++ IPC / Feather V1 writer.
## Version
Reproduced on current `main` at
`35c5ffd12173284406e4a2c86405415444e596d7`.
## Minimal reproduction
```cpp
auto owner = std::make_unique<uint8_t[]>(1);
owner[0] = 0x03;
auto values = std::make_shared<arrow::Buffer>(owner.get(), 1);
auto data = arrow::ArrayData::Make(arrow::boolean(), 1, {nullptr, values},
/*null_count=*/0, /*offset=*/1);
auto array = arrow::MakeArray(data);
auto table = arrow::Table::Make(
arrow::schema({arrow::field("flag", arrow::boolean())}),
{std::make_shared<arrow::ChunkedArray>(array)});
ARROW_ASSIGN_OR_RAISE(auto sink, arrow::io::BufferOutputStream::Create());
auto properties = arrow::ipc::feather::WriteProperties::DefaultsV1();
ARROW_RETURN_NOT_OK(
arrow::ipc::feather::WriteTable(*table, sink.get(), properties));
```
Under ASan, the write deterministically reports a one-byte
heap-buffer-overflow read in `WritePaddedWithOffset` in
`cpp/src/arrow/ipc/feather.cc`.
The same harness with `offset = 0` completes without a sanitizer error.
## Expected behavior
The writer should read only the bitmap bytes required by the logical slice
and
clear unused trailing bits in the serialized bitmap byte.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
