GH-50380: guard byte_substr length against int32 overflow

Author: Arawoof06

cpp/src/gandiva/precompiled/string_ops.cc

@@ -2495,8 +2495,11 @@ const char* byte_substr_binary_int32_int32(gdv_int64 context, const char* text,
     return "";
   }
 
-  // calculate end position from length and truncate to upper value bounds
-  if (startPos + length > text_len) {
+  // calculate end position from length and truncate to upper value bounds.
+  // startPos < text_len is guaranteed above, so text_len - startPos is positive;
+  // comparing against it avoids the startPos + length overflow when length is
+  // near INT32_MAX, which would otherwise leave *out_len huge for the memcpy.
+  if (length > text_len - startPos) {
     *out_len = text_len - startPos;
   } else {
     *out_len = length;

cpp/src/gandiva/precompiled/string_ops_test.cc

@@ -1910,6 +1910,13 @@ TEST(TestStringOps, TestByteSubstr) {
   EXPECT_EQ(out_len, 0);
   EXPECT_EQ(std::string(out_str, out_len), "");
   EXPECT_FALSE(ctx.has_error());
+
+  // a huge length must be truncated to the remaining bytes, not overflow
+  // startPos + length and copy far past the end of the text
+  out_str = byte_substr_binary_int32_int32(ctx_ptr, "TestString", 10, 2,
+                                           2147483647, &out_len);
+  EXPECT_EQ(std::string(out_str, out_len), "estString");
+  EXPECT_FALSE(ctx.has_error());
 }
 
 TEST(TestStringOps, TestStrPos) {