Arawoof06 opened a new issue, #1261: URL: https://github.com/apache/arrow-java/issues/1261
`DictionaryEncoder.retrieveIndexVector` guards each index from the index vector with `indexAsInt > dictionaryCount` before `transfer.copyValueSafe(indexAsInt, i)`. Valid indices are `0..dictionaryCount-1`, so the check is off by one: an index equal to `dictionaryCount` is accepted and reads one slot past the dictionary vector, and a negative index (a signed index type with the high bit set) is not rejected either and also reaches `copyValueSafe`. The index vector is decoded from an IPC/C-data payload, so a crafted dictionary-encoded batch yields an out-of-bounds read of the dictionary vector, exposing adjacent off-heap memory when bounds checking is disabled via `arrow.enable_unsafe_memory_access`. The same helper backs `DictionaryEncoder.decode`, `ListSubfieldEncoder.decodeListSubField` and `StructSubfieldEncoder.decode`. The bound should be `indexAsInt < 0 || indexAsInt >= dictionaryCount`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
