Skip to content

Commit ea3ca57

Browse files
authored
GH-50292: [C++][Parquet] Avoid int64 overflow in CheckReadRangeOrThrow (#50060)
CheckReadRangeOrThrow adds index_location.offset + length unchecked, so a column-chunk page-index location near INT64_MAX wraps past the bounds check and yields an out-of-range buffer offset at read time; guard it with AddWithOverflow as merge_range already does. * GitHub Issue: #50292 Lead-authored-by: metsw24-max <metsw24@gmail.com> Co-authored-by: Sayed Kaif <metsw24@gmail.com> Signed-off-by: Gang Wu <ustcwg@gmail.com>
1 parent 3f4a04e commit ea3ca57

1 file changed

Lines changed: 7 additions & 2 deletions

File tree

cpp/src/parquet/page_index.cc

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -335,9 +335,14 @@ class RowGroupPageIndexReaderImpl : public RowGroupPageIndexReader {
335335
}
336336

337337
/// Page index location must be within the range of the read range.
338+
int64_t index_end = 0;
339+
int64_t range_end = 0;
338340
if (index_location.offset < index_read_range->offset ||
339-
index_location.offset + index_location.length >
340-
index_read_range->offset + index_read_range->length) {
341+
::arrow::internal::AddWithOverflow(index_location.offset, index_location.length,
342+
&index_end) ||
343+
::arrow::internal::AddWithOverflow(index_read_range->offset,
344+
index_read_range->length, &range_end) ||
345+
index_end > range_end) {
341346
throw ParquetException("Page index location [offset:", index_location.offset,
342347
",length:", index_location.length,
343348
"] is out of range from previous WillNeed request [offset:",

0 commit comments

Comments
 (0)