andygrove opened a new issue, #1421: URL: https://github.com/apache/arrow-java/issues/1421
### Describe the bug `ArrowFieldNode` accepts a negative `length` without validation. The IPC (`MessageSerializer.deserializeRecordBatch`), JSON (`JsonFileReader`), and C Data (`ArrayImporter`) deserialization paths all build `ArrowFieldNode` instances directly from externally supplied metadata, so a malformed or hostile input can set a negative node length. A negative length is never valid, but today it propagates into buffer-size math in `BitVectorHelper.loadValidityBuffer` (`getValidityBufferSizeFromCount` performs an unsigned shift, turning a small negative into a ~512 MB allocation) and into `ArrowBuf.setOne` / `setZero` with a negative byte count. With bounds checking enabled this surfaces as an exception after a large buffer has already been allocated and the vector's prior validity buffer released; with bounds checking disabled (`arrow.enable_unsafe_memory_access=true`) the negative length reaches `Unsafe.setMemory` and is reinterpreted as a huge unsigned length. ### Expected behavior Field node length is validated at the point of construction and a negative value is rejected with a clear `IllegalArgumentException` before any buffer is sized or written. ### Component(s) Java -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
