Arawoof06 opened a new issue, #51005:
URL: https://github.com/apache/arrow/issues/51005
`arrow::util::UriFromAbsolutePath(std::string_view path)` in
`cpp/src/arrow/util/uri.cc` passes `path.data()` directly to
`uriUnixFilenameToUriStringA` on the POSIX branch. That vendored routine scans
its argument as a NUL-terminated C string, but a `std::string_view` is not
required to be NUL-terminated. When the view is backed by a larger buffer (or a
heap buffer with no trailing NUL), the conversion reads past the end of the
view; since the output buffer was sized from `path.length()`, a longer run can
also write past it.
The Windows branch above already avoids this by copying into a `std::string`
first.
ASAN on a view over an exact-sized heap buffer:
```
==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
#0 uriUnixFilenameToUriStringA UriFile.c
0 bytes after an 8-byte region (the view's backing buffer, no NUL)
```
### Component(s)
C++
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
