Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ipc: slicing union buffer should validate length

Closed Beginner friendly
  • Is something wrong?
#11,856 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #11881 by @wleeaf — merged

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend, databases

Research direction

Start in arrow-ipc/src/reader.rs at the union buffer slicing on lines 205 and 210. Check how the slice length is validated against the buffer before calling slice_with_length(), then run the supplied test case for a sparse union with too few type IDs. Done means malformed input returns an error instead of panicking.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

when slicing buffers here:

https://github.com/apache/arrow-rs/blob/d03274a7f69d9ec18e2d74920f8b880dd0a722a0/arrow-ipc/src/reader.rs#L194-L214

  • line 205, 210

we trust the input length. this may be invalid/corrupt, but slice_with_length() doesnt report failure so itll just panic.

To Reproduce
    #[test]
    fn test_union_short_type_ids_buffer() {
        use crate::r#gen::Message::{RecordBatch, RecordBatchArgs};

        let fields = UnionFields::from_fields([Field::new("child", DataType::Null, true)]);
        let schema = Arc::new(Schema::new(vec![Field::new(
            "union",
            DataType::Union(fields, UnionMode::Sparse),
            false,
        )]));

        let mut fbb = flatbuffers::FlatBufferBuilder::new();
        let nodes = fbb.create_vector(&[FieldNode::new(2, 0), FieldNode::new(2, 2)]);
        // All buffer ranges fit in the body. Only the union length is inconsistent:
        // sparse has one type id for two rows
        let buffers = fbb.create_vector(&[crate::Buffer::new(0, 1)]);
        let batch = RecordBatch::create(
            &mut fbb,
            &RecordBatchArgs {
                length: 2,
                nodes: Some(nodes),
                buffers: Some(buffers),
                ..Default::default()
            },
        );
        fbb.finish_minimal(batch);
        let batch = flatbuffers::root::<RecordBatch>(fbb.finished_data()).unwrap();

        read_record_batch(
            &Buffer::from(vec![0u8; 16]),
            batch,
            schema,
            &HashMap::new(),
            None,
            &MetadataVersion::V5,
        )
        .expect_err("a short union type-ids buffer should return an error");
    }
  • this test case was generated by codex

output

---- reader::tests::test_union_short_type_ids_buffer stdout ----

thread 'reader::tests::test_union_short_type_ids_buffer' (1224657) panicked at arrow-buffer/src/buffer/immutable.rs:299:9:
the offset of the new Buffer cannot exceed the existing length: slice offset=0 length=2 selflen=1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    reader::tests::test_union_short_type_ids_buffer

test result: FAILED. 141 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.60s
Expected behavior

fix so we report error instead of panicking

Additional context

Reported by Adam Korczynski from ADA Logics, identified by Anthropic

Dominant language
Rust
Stars
3.6k
Forks
1.4k
Avg merge
2d 11h
Merged PRs (30d)
326

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-rs

All issues in apache/arrow-rs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.