GH-50304: [C++][IPC] Reject negative sparse tensor shape and non-zero length

Validate dimension sizes and non_zero_length in GetSparseTensorMetadata so
malformed IPC SparseTensor messages are rejected before the values flow into
buffer-size computations. The now-redundant non-zero-length check in
ReadSparseCSXIndex is removed in favour of this central guard.

Author: rok

cpp/src/arrow/ipc/metadata_internal.cc

@@ -1559,6 +1559,9 @@ Status GetSparseTensorMetadata(const Buffer& metadata, std::shared_ptr<DataType>
       auto dim = sparse_tensor->shape()->Get(i);
 
       if (shape) {
+        if (dim->size() < 0) {
+          return Status::Invalid("Invalid sparse tensor dimension size: ", dim->size());
+        }
         shape->push_back(dim->size());
       }
 
@@ -1569,6 +1572,10 @@ Status GetSparseTensorMetadata(const Buffer& metadata, std::shared_ptr<DataType>
   }
 
   if (non_zero_length) {
+    if (sparse_tensor->non_zero_length() < 0) {
+      return Status::Invalid("Invalid sparse tensor non-zero length: ",
+                             sparse_tensor->non_zero_length());
+    }
     *non_zero_length = sparse_tensor->non_zero_length();
   }
 

cpp/src/arrow/ipc/reader.cc

@@ -2339,9 +2339,6 @@ Result<std::shared_ptr<SparseIndex>> ReadSparseCSXIndex(
   if (shape.size() != 2) {
     return Status::Invalid("Invalid shape length for a sparse matrix");
   }
-  if (non_zero_length < 0) {
-    return Status::Invalid("Invalid non-zero length for a sparse matrix");
-  }
 
   auto* sparse_index = sparse_tensor->sparseIndex_as_SparseMatrixIndexCSX();