GH-50592: [C++][Gandiva] fix out-of-bounds read in evaluate_return_char_length

[Arawoof06]

Rationale for this change

evaluate_return_char_length sizes the lpad/rpad output when the fill text is more than one byte wide. It counts the fill glyphs with utf8_length_ignore_invalid, which charges an invalid or truncated glyph a single byte, then walks the fill text a second time stepping by the width utf8_char_length declares, with no bound on fill_index. The two disagree on malformed fill text: for {0xE0, 'a', 'a'} the count is 3 glyphs so the partial-fill loop runs twice, while its first step consumes all 3 bytes and the second read lands past the end of the fill buffer. It is reached from lpad(text, n, fill) / rpad(text, n, fill) when fill comes from untrusted string data. Reproduced under AddressSanitizer with that fill in an exactly-sized heap buffer, giving heap-buffer-overflow READ ... 0 bytes after 3-byte region.

What changes are included in this PR?

Bound the partial-fill walk by fill_text_len and step over each glyph the way utf8_length_ignore_invalid counted it, so the two stay in sync. Well-formed fill text is unaffected: every glyph fits inside the buffer and has only continuation bytes after its lead byte, so neither the bound nor the invalid-glyph handling comes into play.

Are these changes tested?

Yes. TestStringOps.TestPadMalformedUtf8FillNoOverread runs lpad/rpad with the truncated fill held in an exactly-sized heap buffer so the over-read trips ASAN, and asserts the padded output. Before the fix it reports out_len 9 and trailing bytes read from past the buffer; after it reports 7. The rest of gandiva-precompiled-test still passes.

Are there any user-facing changes?

No.

This PR contains a "Critical Fix". It fixes an out-of-bounds read in the Gandiva pad sizing helper reachable from lpad/rpad with crafted fill text.

• GitHub Issue: [C++][Gandiva] Out-of-bounds read in evaluate_return_char_length with malformed pad fill text #50592

[github-actions]

⚠️ GitHub issue #50592 has been automatically assigned in GitHub to PR creator.

[github-actions]

⚠️ GitHub issue #50592 has no components, please add labels for components.