Commit ea3ca57
authored
CheckReadRangeOrThrow adds index_location.offset + length unchecked, so a column-chunk page-index location near INT64_MAX wraps past the bounds check and yields an out-of-range buffer offset at read time; guard it with AddWithOverflow as merge_range already does.
* GitHub Issue: #50292
Lead-authored-by: metsw24-max <metsw24@gmail.com>
Co-authored-by: Sayed Kaif <metsw24@gmail.com>
Signed-off-by: Gang Wu <ustcwg@gmail.com>
1 parent 3f4a04e commit ea3ca57
1 file changed
Lines changed: 7 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
335 | 335 | | |
336 | 336 | | |
337 | 337 | | |
| 338 | + | |
| 339 | + | |
338 | 340 | | |
339 | | - | |
340 | | - | |
| 341 | + | |
| 342 | + | |
| 343 | + | |
| 344 | + | |
| 345 | + | |
341 | 346 | | |
342 | 347 | | |
343 | 348 | | |
| |||
0 commit comments