Skip to content

fix(ipc): validate block lengths before allocation - #11012

Open
KHARSHAVARDHAN-eng wants to merge 1 commit into
apache:mainfrom
KHARSHAVARDHAN-eng:fix-ipc-block-length-allocation
Open

fix(ipc): validate block lengths before allocation#11012
KHARSHAVARDHAN-eng wants to merge 1 commit into
apache:mainfrom
KHARSHAVARDHAN-eng:fix-ipc-block-length-allocation

Conversation

@KHARSHAVARDHAN-eng

Copy link
Copy Markdown

Closes #10921

Summary

  • Validate IPC footer block offsets and lengths against the file size before allocating the block buffer.
  • Use checked integer conversions and arithmetic for block offsets and lengths.
  • Add a regression test covering oversized, negative, out-of-bounds, and overflowing block metadata.

Validation

  • cargo fmt --check
  • cargo clippy -p arrow-ipc --all-targets -- -D warnings
  • cargo test -p arrow-ipc
  • git diff --check

@github-actions github-actions Bot added arrow Changes to the arrow crate arrow-ipc labels Sep 7, 2026
Comment thread arrow-ipc/src/reader.rs
let body_len = block.bodyLength().to_usize().unwrap();
let metadata_len = block.metaDataLength().to_usize().unwrap();
let total_len = body_len.checked_add(metadata_len).unwrap();
let offset = u64::try_from(block.offset())

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: might be worth placing all the parsing Errors into a anon function that takes in a string. either way otherwise this makes sense 👍

@apache apache deleted a comment Sep 8, 2026
Comment thread arrow-ipc/src/reader.rs Outdated
ArrowError::ParseError("Block body length + metadata length overflowed usize".to_string())
})?;

let file_len = reader.seek(SeekFrom::End(0))?;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we probably should pass in the file length to the function, instead of re-seeking for every block read

@KHARSHAVARDHAN-eng
KHARSHAVARDHAN-eng force-pushed the fix-ipc-block-length-allocation branch from b94fc60 to a4921f1 Compare September 9, 2026 07:43
@KHARSHAVARDHAN-eng

Copy link
Copy Markdown
Author

Thanks for the review! I’ve addressed Jeffrey’s suggestion by calculating the file length once and passing it through to read_block, avoiding repeated end-of-file seeks. The changes have been verified with formatting, clippy, and the full arrow-ipc test suite. Ready for review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

arrow Changes to the arrow crate arrow-ipc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

arrow-ipc: a footer block's declared body length is zero-filled before it is read

3 participants