Repository navigation
[C++] Reading a MapArray from invalid IPC stream/file can read memory out of bounds #54936
Description
Describe the bug, including details regarding any error messages, version, and platform.
When loading a MapArray from IPC, we call MapArray::ValidateChildData to avoid a later crash in MapArray::SetData.
Unfortunately MapArray::ValidateChildData calls GetNullCount() which is unsafe if the advertised length is too large for the actual validity buffer size.
Found by OSS-Fuzz in https://issues.oss-fuzz.com/issues/556994537
Component(s)
C++
Activity
apacheGH-54936: [C++] Ensure reading an invalid map array from IPC do…
apacheGH-54936: [C++] Ensure reading an invalid map array from IPC do…
GH-54936: [C++] Ensure reading an invalid map array from IPC doesn't …
pitrou commentedon Oct 29, 2026
Issue resolved by pull request 54939
#54939
GH-54936: [C++] Ensure reading an invalid map array from IPC doesn't …