chrisqiqiu commented on issue #14391: URL: https://github.com/apache/iceberg/issues/14391#issuecomment-3446864145
Yes, it's related to orc (org/apache/orc/protobuf/ and com/google/protobuf). Pls see below for the class reported Root Cause iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$ArrayDecoder.class[3.1.0 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$StreamDecoder.class[3.1.0 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$UnsafeDirectNioDecoder.class[3.1.0 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$IterableDirectByteBufferDecoder.class[3.5.0 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/ArrayDecoders.class[3.8.0-rc-1 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/UnknownFieldSchema.class[3.8.0-rc-1 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$ArrayDecoder.class[4.0.0-rc-1 , 4.27.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$IterableDirectByteBufferDecoder.class[4.0.0-rc-1 , 4.27.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$StreamDecoder.class[4.0.0-rc-1 , 4.27.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$UnsafeDirectNioDecoder.class[4.0.0-rc-1 , 4.27.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/UnknownFieldSchema.class[4.0.0-rc-1 , 4.27.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$ArrayDecoder.class[3.19.0.rc.1 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$StreamDecoder.class[3.19.0.rc.1 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$UnsafeDirectNioDecoder.class[3.19.0.rc.1 , 3.25.5) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$ArrayDecoder.class[4.28.0-rc-1 , 4.28.2) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$IterableDirectByteBufferDecoder.class[4.28.0-rc-1 , 4.28.2) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/CodedInputStream$UnsafeDirectNioDecoder.class[4.28.0-rc-1 , 4.28.2) iceberg-spark-runtime-3.5_2.12-1.10.0.jarorg/apache/iceberg/shaded/org/apache/orc/protobuf/UnknownFieldSchema.class[4.28.0-rc-1 , 4.28.2) Vulnerable Package(s): gem : google-protobuf maven : com.google.protobuf : protobuf-java maven : com.google.protobuf : protobuf-javalite maven : com.google.protobuf : protobuf-kotlin maven : com.google.protobuf : protobuf-kotlin-lite Vulnerable File(s) and Function(s): com/google/protobuf/UnknownFieldSchema.class final boolean mergeOneFieldFrom(B unknownFields, Reader reader) throws IOException com/google/protobuf/ArrayDecoders.class static int mergeMessageField(Object msg, Schema schema, byte[] data, int position, int limit, Registers registers) throws IOException static int mergeGroupField(Object msg, Schema schema, byte[] data, int position, int limit, int endGroup, Registers registers) throws IOException static int decodeUnknownField(int tag, byte[] data, int position, int limit, UnknownFieldSetLite unknownFields, Registers registers) throws InvalidProtocolBufferException com/google/protobuf/CodedInputStream$ArrayDecoder.class public void skipMessage() throws IOException public void skipMessage(CodedOutputStream output) throws IOException com/google/protobuf/CodedInputStream$IterableDirectByteBufferDecoder.class public void skipMessage() throws IOException public void skipMessage(CodedOutputStream output) throws IOException com/google/protobuf/CodedInputStream$UnsafeDirectNioDecoder.class public void skipMessage() throws IOException public void skipMessage(CodedOutputStream output) throws IOException com/google/protobuf/CodedInputStream$StreamDecoder.class public void skipMessage() throws IOException public void skipMessage(CodedOutputStream output) throws IOException -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
