professor-moody opened a new issue, #55400: URL: https://github.com/apache/arrow/issues/55400
### Describe the bug, including details regarding any error messages, version, and platform. The `ipc::ReadMessage(int64_t offset, int32_t metadata_length, int64_t body_length, io::RandomAccessFile* file)` overload and `ipc::ReadMessageAsync` in `cpp/src/arrow/ipc/message.cc` read `metadata_length + body_length` bytes in a single IO operation and then pass `SliceBuffer(metadata, 0, metadata_length)` to the message decoder. Neither function validates `body_length` before issuing the read: 1. When `body_length < 0`, `metadata_length + body_length` is smaller than `metadata_length`, so the read returns fewer than `metadata_length` bytes while `SliceBuffer(metadata, 0, metadata_length)` keeps the full `metadata_length` length (`ReadMessageContinued` only checks `DCHECK_EQ` in debug builds). 2. When `body_length > std::numeric_limits<int64_t>::max() - metadata_length`, the sum `metadata_length + body_length` overflows signed 64-bit arithmetic. While `RecordBatchFileReader` validates footer blocks in `FileBlockFromFlatbuffer` before calling these functions, direct callers of `ipc::ReadMessage` and `ipc::ReadMessageAsync` do not get that check. ### Expected behavior `ReadMessageInternal` (when `body_length.has_value()`) and `ReadMessageAsync` should return `Status::Invalid` if `body_length < 0` or `body_length > std::numeric_limits<int64_t>::max() - metadata_length` before issuing any read. ### Component(s) C++ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
