[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBs

Open Beginner friendly
#1,230 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
backend, database

Research direction

Locate ClobConsumer and compare its VarCharVector data-buffer growth guard with the sibling BinaryConsumer check. Reproduce with a CLOB whose UTF-8 data exceeds the initial allocation, then verify that cumulative CLOB or batch data does not corrupt the offset buffer and can be read back successfully.

Written by the indexing model from the issue text.

Description

ClobConsumer copies CLOB data into the VarCharVector data buffer with MemoryUtil.copyToMemory at offset startIndex + totalBytes, but the buffer-growth guard checks dataBuffer.writerIndex() + bytes.length > dataBuffer.capacity(). copyToMemory never advances writerIndex(), and nothing else does either, so it stays at 0 and the guard only ever checks that a single chunk fits at offset 0. Once the cumulative bytes of a CLOB (or a batch of CLOB rows) exceed the initial data-buffer allocation of about 32 KB, reallocDataBuffer() is never called and copyToMemory, which performs no ArrowBuf bounds checking, writes past the allocation into adjacent off-heap memory.

The sibling BinaryConsumer uses the correct check: while (vector.getDataBuffer().capacity() < (startOffset + dataLength + read)).

To reproduce, consume a single CLOB whose UTF-8 length exceeds the initial data buffer (for example INITIAL_VALUE_ALLOCATION * 8 * 4 characters). The out-of-bounds write corrupts the adjacent offset buffer, and reading the value back throws NegativeArraySizeException.

Dominant language
Java
Stars
95
Forks
154
Avg merge
2d 16h
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-java

All issues in apache/arrow-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.