Arawoof06 opened a new issue, #50893: URL: https://github.com/apache/arrow/issues/50893
### Describe the bug `soundex_utf8` in `cpp/src/gandiva/precompiled/string_ops.cc` looks up each soundex digit in a 26-entry `mappings[]` table (indices for A-Z), but it classifies characters and folds case with the locale-sensitive `isalpha`/`toupper`. Under a non-C locale (for example `en_US.UTF-8` or an ISO-8859 locale), `isalpha` accepts bytes `0x80`-`0xFF` as letters and `toupper` leaves them past `'Z'`, so `mappings[toupper(byte) - 'A']` reads past the end of the 26-element table. This is reachable from SQL `soundex()` on untrusted string data. Under AddressSanitizer this shows up as a global-buffer-overflow read on `mappings` for an input byte such as `0xAA` when the process locale classifies it as a letter. ### Component(s) C++, Gandiva -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
