Out-of-bounds read for corrupt view offsets in BaseVariableWidthViewVector

Open
#1,217 0 comments 0 reactions 0 assignees View on GitHub

@lidavidm is already working on this.

Since Sep 10, 2026.

  • #1291 by @lidavidm — open

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
java
Domain
security

Research direction

Start in BaseVariableWidthViewVector and inspect the out-of-line view handling in getData, getDataPointer, hashCode, copyFromNotNull, and splitAndTransferViewBufferAndDataBuffer. Compare the linked pull request, then verify that corrupt buffer indexes and offset/length ranges no longer permit out-of-bounds reads, including with unsafe memory access enabled.

Written by the indexing model from the issue text.

Description

Describe the bug

ViewVarCharVector/ViewVarBinaryVector store values longer than INLINE_SIZE (12 bytes) out of line, encoding a data-buffer index and an offset inline in the view buffer. When a vector is loaded from an IPC stream these fields come straight from the input.

BaseVariableWidthViewVector dereferences them verbatim in getData, getDataPointer, hashCode, copyFromNotNull and splitAndTransferViewBufferAndDataBuffer, e.g.

dataBuffers.get(bufferIndex).getBytes(dataOffset, result, 0, dataLength);

Nothing checks that bufferIndex is in range or that dataOffset + dataLength fits inside the referenced data buffer. A crafted view whose offset/length points past the data buffer produces an out-of-bounds read: with the default bounds checking it throws IndexOutOfBoundsException, but with arrow.enable_unsafe_memory_access=true (commonly set in production) it reads arbitrary native heap into the returned value.

Component(s)

Java

Dominant language
Java
Stars
95
Forks
154
Avg merge
2d 16h
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-java

All issues in apache/arrow-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.