Describe the bug, including details regarding any error messages, version, and platform.
RowGroupPageIndexReaderImpl::CheckReadRangeOrThrow in cpp/src/parquet/page_index.cc validates that a column chunk's page-index location lies inside the coalesced WillNeed read range using raw signed int64 additions:
if (index_location.offset < index_read_range->offset ||
index_location.offset + index_location.length >
index_read_range->offset + index_read_range->length) {The offset/length come from the Thrift ColumnChunk metadata. For a column outside a WillNeed selection these are not otherwise bounds-checked here, so an offset near INT64_MAX wraps offset + length to a negative value (signed-overflow UB, confirmed under UBSan). The out-of-range check then passes, and GetColumnIndex/GetOffsetIndex go on to compute buffer_offset = location.offset - range.offset and read length bytes at buffer->data() + buffer_offset, an out-of-bounds read.
The neighbouring merge_range logic in the same file already uses AddWithOverflow; this check should do the same.
Component(s)
C++, Parquet
Describe the bug, including details regarding any error messages, version, and platform.
RowGroupPageIndexReaderImpl::CheckReadRangeOrThrowincpp/src/parquet/page_index.ccvalidates that a column chunk's page-index location lies inside the coalescedWillNeedread range using raw signed int64 additions:if (index_location.offset < index_read_range->offset || index_location.offset + index_location.length > index_read_range->offset + index_read_range->length) {The
offset/lengthcome from the ThriftColumnChunkmetadata. For a column outside aWillNeedselection these are not otherwise bounds-checked here, so an offset nearINT64_MAXwrapsoffset + lengthto a negative value (signed-overflow UB, confirmed under UBSan). The out-of-range check then passes, andGetColumnIndex/GetOffsetIndexgo on to computebuffer_offset = location.offset - range.offsetand readlengthbytes atbuffer->data() + buffer_offset, an out-of-bounds read.The neighbouring
merge_rangelogic in the same file already usesAddWithOverflow; this check should do the same.Component(s)
C++, Parquet