b84330808 opened a new issue, #55388: URL: https://github.com/apache/arrow/issues/55388
### Describe the bug, including details regarding any error messages, version, and platform. Out-of-bounds dictionary indices in RLE_DICTIONARY pages are not rejected consistently: 1. `DictDecoder::DecodeIndices()` (both overloads) and `DecodeIndicesSpaced()` don't check the indices against the dictionary length. They are used by `ReadBatchWithDictionary()` and when reading BYTE_ARRAY columns with `read_dictionary`, so the result can hold indices past the end of the dictionary. 2. When `RleBitPackedDecoder::GetBatchWithDict[Spaced]()` resumes a run left partially read by a previous call and finds an invalid index there, it doesn't stop but moves on to the next run. In release builds this silently skips the invalid values (`Decode()` returns the values of the next run instead of failing). If the run is an RLE run, the validity bookkeeping goes out of sync and the call never returns (100% CPU). In debug builds it hits `Check failed: run_remaining() == 0`. 3. Same for a bit-packed run longer than 1024 values where the invalid index is not in the first 1024 values. Example for (2), with the decoders on current main (dictionary of 3 values, bit width 8, an RLE run of 8 x index 200, then a bit-packed run of 8 valid indices): ```cpp RleBitPackedDecoder<int32_t> decoder(buffer.data(), buffer.size(), 8); decoder.GetBatch(indices, 4); // 4 decoder.GetBatchWithDict(dict, 3, out, 8); // never returns ``` A ~2 KB Parquet file reaches this through the public API: `RowGroupReader::RecordReader(i, /*read_dictionary=*/true)`, then `ReadRecords()` followed by `SkipRecords()`. ### Component(s) C++, Parquet I found this with Claude Code and a local fuzz harness over the RecordReader and low-level reader APIs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
