GH-50380: [C++][Gandiva] fix out-of-bounds read in byte_substr past end

Signed-off-by: abdul rawoof <abdulr@bugqore.com>

Author: Arawoof06

cpp/src/gandiva/precompiled/string_ops.cc

@@ -2487,6 +2487,13 @@ const char* byte_substr_binary_int32_int32(gdv_int64 context, const char* text,
     startPos = text_len + offset;
   }
 
+  // an offset past the end of the text leaves nothing to copy; without this the
+  // truncation below yields a negative *out_len that memcpy reads as a huge size
+  if (startPos >= text_len) {
+    *out_len = 0;
+    return "";
+  }
+
   // calculate end position from length and truncate to upper value bounds
   if (startPos + length > text_len) {
     *out_len = text_len - startPos;

cpp/src/gandiva/precompiled/string_ops_test.cc

@@ -1903,6 +1903,13 @@ TEST(TestStringOps, TestByteSubstr) {
   out_str = byte_substr_binary_int32_int32(ctx_ptr, "TestString", 10, -100, 10, &out_len);
   EXPECT_EQ(std::string(out_str, out_len), "TestString");
   EXPECT_FALSE(ctx.has_error());
+
+  // offset past the end of the text must yield an empty result, not a negative
+  // length that memcpy reads as an out-of-bounds copy
+  out_str = byte_substr_binary_int32_int32(ctx_ptr, "TestString", 10, 15, 10, &out_len);
+  EXPECT_EQ(out_len, 0);
+  EXPECT_EQ(std::string(out_str, out_len), "");
+  EXPECT_FALSE(ctx.has_error());
 }
 
 TEST(TestStringOps, TestStrPos) {