JingsongLi commented on PR #565:
URL: https://github.com/apache/paimon-rust/pull/565#issuecomment-5030096234
- `deserialize_binary_array_long` directly calls `push(None)` on null
elements without first verifying the required 8-byte fixed slot for each
element. A small input forged with an “extremely large count + all-null bitmap
+ no element slots” will be accepted and result in approximately 128-fold
memory amplification; this entry point is exposed to C calls, which may cause
the process to run out of memory (OOM). A validation check for `header + count
* 8 <= data.len()` should be performed before the loop.
- Additionally, `beforeDeletionFiles` is silently discarded when it is
non-null, whereas Java would reject such a split. It is recommended to maintain
compatibility and fail loudly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
