Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ipc: slicing buffer should not panic on invalid slice

Closed Beginner friendly
  • Is something wrong?
#11,857 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #11881 by @wleeaf — merged

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
databases

Research direction

Start with the linked slice operation in arrow-ipc/src/reader.rs and the failing test test_read_record_batch_buffer_out_of_bounds described in the issue. Trace how the IPC buffer offset and length reach slice_with_length, then run that test. Done means the invalid range returns an error and the test passes without a panic.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

https://github.com/apache/arrow-rs/blob/d03274a7f69d9ec18e2d74920f8b880dd0a722a0/arrow-ipc/src/reader.rs#L59-L74

slice_with_length could panic here as i dont believe offset & len are controlled/validated. we should ensure if an invalid slice is taken it should error, not panic

To Reproduce
    #[test]
    fn test_read_record_batch_buffer_out_of_bounds() {
        use crate::r#gen::Message::{RecordBatch, RecordBatchArgs};
        use flatbuffers::FlatBufferBuilder;

        let schema = Arc::new(Schema::new(vec![Field::new("col", DataType::Int32, false)]));
        let body = Buffer::from(vec![0u8; 8]);
        let mut fbb = FlatBufferBuilder::new();
        let nodes = fbb.create_vector(&[FieldNode::new(2, 0)]);
        // Empty validity buffer followed by two Int32 values whose range exceeds the body.
        let buffers = fbb.create_vector(&[crate::Buffer::new(0, 0), crate::Buffer::new(4, 8)]);
        let batch = RecordBatch::create(
            &mut fbb,
            &RecordBatchArgs {
                length: 2,
                nodes: Some(nodes),
                buffers: Some(buffers),
                ..Default::default()
            },
        );
        fbb.finish_minimal(batch);
        let batch = flatbuffers::root::<RecordBatch>(fbb.finished_data()).unwrap();

        let result = read_record_batch(
            &body,
            batch,
            schema,
            &HashMap::new(),
            None,
            &MetadataVersion::V5,
        );

        assert!(
            result.is_err(),
            "invalid IPC buffer range must return an error"
        );
    }
  • test generated by codex

output

---- reader::tests::test_read_record_batch_buffer_out_of_bounds stdout ----

thread 'reader::tests::test_read_record_batch_buffer_out_of_bounds' (1273563) panicked at arrow-buffer/src/buffer/immutable.rs:299:9:
the offset of the new Buffer cannot exceed the existing length: slice offset=4 length=8 selflen=8
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    reader::tests::test_read_record_batch_buffer_out_of_bounds

test result: FAILED. 141 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.54s
Expected behavior

should error and not panic

Additional context

Reported by Adam Korczynski from ADA Logics, identified by Anthropic

Dominant language
Rust
Stars
3.6k
Forks
1.4k
Avg merge
2d 8h
Merged PRs (30d)
332

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/arrow-rs

All issues in apache/arrow-rs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.