Skip to content

More missing bound checks #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PedroTadim merged 1 commit into from
Oct 2, 2026
Merged

More missing bound checks #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion c++/src/Reader.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -523,7 +523,14 @@ namespace orc {
for (int i = 0; i < currentStripeFooter_.streams_size(); ++i) {
const proto::Stream& pbStream = currentStripeFooter_.streams(i);
uint64_t colId = pbStream.column();
if (selectedColumns_[colId] && pbStream.has_kind() &&
if (pbStream.has_kind() && colId >= selectedColumns_.size()) {
std::stringstream msg;
msg << "Malformed stream meta at stream index " << i << " in stripe " << currentStripe_
<< ": column=" << colId << " is out of range, the file has " << selectedColumns_.size()
<< " columns";
throw ParseError(msg.str());
}
if (pbStream.has_kind() && selectedColumns_[colId] &&
(pbStream.kind() == proto::Stream_Kind_ROW_INDEX ||
pbStream.kind() == proto::Stream_Kind_BLOOM_FILTER_UTF8)) {
std::unique_ptr<SeekableInputStream> inStream;
Expand Down Expand Up @@ -556,6 +563,14 @@ namespace orc {
if (!parseProtobufFromStream(&pbBFIndex, inStream.get())) {
throw ParseError("Failed to parse bloom filter index");
}
if (colId >= static_cast<uint64_t>(currentStripeFooter_.columns_size())) {
std::stringstream msg;
msg << "Malformed bloom filter stream at stream index " << i << " in stripe "
<< currentStripe_ << ": column=" << colId
<< " has no column encoding, the stripe has " << currentStripeFooter_.columns_size()
<< " column encodings";
throw ParseError(msg.str());
}
BloomFilterIndex bfIndex;
for (int j = 0; j < pbBFIndex.bloom_filter_size(); j++) {
bfIndex.entries.push_back(BloomFilterUTF8Utils::deserialize(
Expand Down Expand Up @@ -835,6 +850,13 @@ namespace orc {
}
int num_entries = rowIndex.entry_size();
size_t column = static_cast<size_t>(stream.column());
if (column >= indexStats->size()) {
std::stringstream msg;
msg << "Malformed RowIndex stream meta at stream index " << i << " in stripe "
<< stripeIndex << ": column=" << column << " is out of range, the stripe has "
<< indexStats->size() << " column statistics";
throw ParseError(msg.str());
}
for (int j = 0; j < num_entries; j++) {
const proto::RowIndexEntry& entry = rowIndex.entry(j);
(*indexStats)[column].push_back(entry.statistics());
Expand Down Expand Up @@ -1733,6 +1755,14 @@ namespace orc {
if (!parseProtobufFromStream(&pbBFIndex, pbStream.get())) {
throw ParseError("Failed to parse BloomFilterIndex");
}
if (stream.column() >= static_cast<uint64_t>(currentStripeFooter.columns_size())) {
std::stringstream msg;
msg << "Malformed bloom filter stream at stream index " << i << " in stripe "
<< stripeIndex << ": column=" << stream.column()
<< " has no column encoding, the stripe has " << currentStripeFooter.columns_size()
<< " column encodings";
throw ParseError(msg.str());
}

BloomFilterIndex bfIndex;
for (int j = 0; j < pbBFIndex.bloom_filter_size(); j++) {
Expand Down
Loading