From c22b9e3c8e7c88c36bbd5e6f56df258f48489923 Mon Sep 17 00:00:00 2001 From: metsw24-max Date: Wed, 27 May 2026 18:23:09 +0530 Subject: [PATCH 1/3] GH-50054: [C++][IPC] Validate indices buffer size in ReadSparseCOOIndex --- cpp/src/arrow/ipc/reader.cc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cpp/src/arrow/ipc/reader.cc b/cpp/src/arrow/ipc/reader.cc index 512305d6570a..cc3b550414c2 100644 --- a/cpp/src/arrow/ipc/reader.cc +++ b/cpp/src/arrow/ipc/reader.cc @@ -2293,6 +2293,14 @@ Result> ReadSparseCOOIndex( file->ReadAt(indices_buffer->offset(), indices_buffer->length(), /*allow_short_read=*/false)); std::vector indices_shape({non_zero_length, ndim}); + int64_t indices_minimum_bytes; + if (arrow::internal::MultiplyWithOverflow(non_zero_length, ndim, + &indices_minimum_bytes) || + arrow::internal::MultiplyWithOverflow(indices_minimum_bytes, indices_elsize, + &indices_minimum_bytes) || + indices_minimum_bytes > indices_buffer->length()) { + return Status::Invalid("shape is inconsistent to the size of indices buffer"); + } auto* indices_strides = sparse_index->indicesStrides(); std::vector strides(2); if (indices_strides && indices_strides->size() > 0) { From e7ac2b20f97777e46515f20862462ca780b2e5a9 Mon Sep 17 00:00:00 2001 From: Rok Mihevc Date: Tue, 30 Jun 2026 14:11:38 +0200 Subject: [PATCH 2/3] Update cpp/src/arrow/ipc/reader.cc --- cpp/src/arrow/ipc/reader.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/src/arrow/ipc/reader.cc b/cpp/src/arrow/ipc/reader.cc index cc3b550414c2..4991c8beb44a 100644 --- a/cpp/src/arrow/ipc/reader.cc +++ b/cpp/src/arrow/ipc/reader.cc @@ -2294,9 +2294,9 @@ Result> ReadSparseCOOIndex( /*allow_short_read=*/false)); std::vector indices_shape({non_zero_length, ndim}); int64_t indices_minimum_bytes; - if (arrow::internal::MultiplyWithOverflow(non_zero_length, ndim, + if (MultiplyWithOverflow(non_zero_length, ndim, &indices_minimum_bytes) || - arrow::internal::MultiplyWithOverflow(indices_minimum_bytes, indices_elsize, + MultiplyWithOverflow(indices_minimum_bytes, indices_elsize, &indices_minimum_bytes) || indices_minimum_bytes > indices_buffer->length()) { return Status::Invalid("shape is inconsistent to the size of indices buffer"); From c3c383f20637024d3cd5cb4fdc3431ff647ad998 Mon Sep 17 00:00:00 2001 From: Rok Mihevc Date: Tue, 30 Jun 2026 14:23:33 +0200 Subject: [PATCH 3/3] Apply suggestion from @rok --- cpp/src/arrow/ipc/reader.cc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/cpp/src/arrow/ipc/reader.cc b/cpp/src/arrow/ipc/reader.cc index 4991c8beb44a..02e9e5776987 100644 --- a/cpp/src/arrow/ipc/reader.cc +++ b/cpp/src/arrow/ipc/reader.cc @@ -2294,10 +2294,9 @@ Result> ReadSparseCOOIndex( /*allow_short_read=*/false)); std::vector indices_shape({non_zero_length, ndim}); int64_t indices_minimum_bytes; - if (MultiplyWithOverflow(non_zero_length, ndim, - &indices_minimum_bytes) || + if (MultiplyWithOverflow(non_zero_length, ndim, &indices_minimum_bytes) || MultiplyWithOverflow(indices_minimum_bytes, indices_elsize, - &indices_minimum_bytes) || + &indices_minimum_bytes) || indices_minimum_bytes > indices_buffer->length()) { return Status::Invalid("shape is inconsistent to the size of indices buffer"); }