nssalian commented on code in PR #16568:
URL: https://github.com/apache/iceberg/pull/16568#discussion_r3531113380
##########
api/src/main/java/org/apache/iceberg/variants/SerializedObject.java:
##########
@@ -60,18 +64,33 @@ static SerializedObject from(VariantMetadata metadata,
ByteBuffer value, int hea
private final int[] offsets;
private final int[] lengths;
private final int dataOffset;
+ private final int depth;
private final VariantValue[] values;
- private SerializedObject(VariantMetadata metadata, ByteBuffer value, int
header) {
+ private SerializedObject(VariantMetadata metadata, ByteBuffer value, int
header, int depth) {
this.metadata = metadata;
this.value = value;
+ this.depth = depth;
this.offsetSize = 1 + ((header & OFFSET_SIZE_MASK) >> OFFSET_SIZE_SHIFT);
this.fieldIdSize = 1 + ((header & FIELD_ID_SIZE_MASK) >>
FIELD_ID_SIZE_SHIFT);
int numElementsSize = ((header & IS_LARGE) == IS_LARGE) ? 4 : 1;
+ Preconditions.checkArgument(
+ value.remaining() >= HEADER_SIZE + numElementsSize,
+ "Invalid variant object: buffer too small for element count field");
int numElements = ByteBuffers.readLittleEndianUnsigned(value, HEADER_SIZE,
numElementsSize);
+ Preconditions.checkArgument(
+ numElements >= 0, "Invalid variant object: negative element count %s",
numElements);
this.fieldIdListOffset = HEADER_SIZE + numElementsSize;
- this.fieldIds = new Integer[numElements];
+ long dataStart =
+ (long) fieldIdListOffset
+ + (long) numElements * fieldIdSize
+ + ((long) numElements + 1L) * offsetSize;
+ Preconditions.checkArgument(
+ dataStart <= value.remaining(),
Review Comment:
Fixed - both offsets are now derived from a long dataStart intermediate and
Math.toIntExact-ed, so the guard protects the values we use downstream.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
