Arawoof06 opened a new issue, #1217: URL: https://github.com/apache/arrow-java/issues/1217
### Describe the bug `ViewVarCharVector`/`ViewVarBinaryVector` store values longer than `INLINE_SIZE` (12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input. `BaseVariableWidthViewVector` dereferences them verbatim in `getData`, `getDataPointer`, `hashCode`, `copyFromNotNull` and `splitAndTransferViewBufferAndDataBuffer`, e.g. ```java dataBuffers.get(bufferIndex).getBytes(dataOffset, result, 0, dataLength); ``` Nothing checks that `bufferIndex` is in range or that `dataOffset + dataLength` fits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throws `IndexOutOfBoundsException`, but with `arrow.enable_unsafe_memory_access=true` (commonly set in production) it reads arbitrary native heap into the returned value. ### Component(s) Java -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
