Skip to content

Commit 0cbc056

Browse files
committed
GH-47803: [C++][Parquet] Fix read out of bounds on invalid RLE data
Found by OSS-Fuzz, should fix https://issues.oss-fuzz.com/issues/451150486.
1 parent bfce5f2 commit 0cbc056

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

cpp/src/arrow/util/rle_encoding_internal.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -699,6 +699,11 @@ auto RleBitPackedParser::PeekImpl(Handler&& handler) const
699699
ARROW_DCHECK_LT(value_bytes, internal::max_size_for_v<rle_size_t>);
700700
const auto bytes_read = header_bytes + static_cast<rle_size_t>(value_bytes);
701701

702+
if (ARROW_PREDICT_FALSE(bytes_read > data_size_)) {
703+
// RLE run would overflow data buffer
704+
return {0, ControlFlow::Break};
705+
}
706+
702707
auto control =
703708
handler.OnRleRun(RleRun(data_ + header_bytes, values_count, value_bit_width_));
704709

0 commit comments

Comments
 (0)