Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

parquet: ParquetMetaDataPushDecoder panics (subtract with overflow) when the footer metadata length exceeds the file size

Open Beginner friendly
  • Is something wrong?
#11,690 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@ump45nose is already working on this.

Since Oct 19, 2026.

  • #11697 by @ump45nose — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend, databases

Research direction

Start in parquet/src/file/metadata/push_decoder.rs at ParquetMetaDataPushDecoder::try_decode, where the issue shows the unchecked footer length subtraction. Compare its error handling with ParquetMetaDataReader::parse_and_finish on the same malformed 12-byte input. Done when the push decoder returns a ParquetError instead of panicking for an oversized metadata length.

Written by the indexing model from the issue text.

Description

Describe the bug

ParquetMetaDataPushDecoder::try_decode computes the start of the metadata from the footer's metadata length without checking it against the file length (parquet/src/file/metadata/push_decoder.rs):

let metadata_len: u64 = footer_tail.metadata_length() as u64;
let metadata_start = file_len - footer_len - metadata_len;
let metadata_end = metadata_start + metadata_len;

If the footer claims a metadata length larger than file_len - 8, the subtraction underflows:

  • with overflow checks (debug builds) it panics with attempt to subtract with overflow;
  • without them the value wraps, metadata_end wraps back to a small value, and the decoder then panics in Bytes::slice (range start must not be greater than end).

ParquetMetaDataReader::parse_and_finish on the same bytes returns EOF("Parquet file too small. Size is 12 but need 1008"), so only the push decoder is affected.

To Reproduce

With parquet = "60.0.0":

use parquet::file::metadata::ParquetMetaDataPushDecoder;
use parquet::DecodeResult;

fn main() {
    // A 12-byte "file": 4 bytes of data, then a footer whose metadata
    // length (1000) is larger than the file.
    let mut file = vec![0u8; 4];
    file.extend_from_slice(&1000u32.to_le_bytes());
    file.extend_from_slice(b"PAR1");
    let len = file.len() as u64;

    let mut decoder = ParquetMetaDataPushDecoder::try_new(len).unwrap();
    decoder.push_range(0..len, file.into()).unwrap();
    match decoder.try_decode() {
        Ok(DecodeResult::NeedsData(r)) => println!("needs data: {r:?}"),
        Ok(DecodeResult::Data(_)) => println!("data"),
        Ok(DecodeResult::Finished) => println!("finished"),
        Err(e) => println!("error: {e}"),
    }
}

Debug build:

thread 'main' panicked at parquet-60.0.0/src/file/metadata/push_decoder.rs:390:42:
attempt to subtract with overflow

Release build:

thread 'main' panicked at bytes-1.12.1/src/bytes.rs:374:28:
range start must not be greater than end: 18446744073709550620 <= 4

(from bytes::Bytes::slice called by ParquetMetaDataPushDecoder::try_decode)

Expected behavior

try_decode returns a ParquetError (like ParquetMetaDataReader, e.g. "file too small ... need N bytes") instead of panicking.

Additional context
  • Reproduces with parquet 60.0.0 and on main at 33d338ddf (push_decoder.rs:430).
  • Found while fuzzing a Parquet reader built on arrow-rs. Related: #9742, #10563.
Dominant language
Rust
Stars
3.6k
Forks
1.4k
Avg merge
2d 23h
Merged PRs (30d)
237

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-rs

All issues in apache/arrow-rs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.