ArrowFlightJdbcArray.getArray(index, count) can read past the end of the array slice

ArrowFlightJdbcArray.checkBoundaries から始め、getArray(index, count) と getResultSet(index, count) の両方の呼び出し箇所を調査します。ゼロではない startOffset を使用した回帰テストを、提供されている IntVector のスライスなどを使って追加し、既存の ArrowFlightJdbcArray テストを実行します。完了の条件は、リクエストが配列スライスの範囲を超えて読み取れないことです。

ArrowFlightJdbcArray.checkBoundaries validates the caller-supplied index against startOffset + valuesCount:

private void checkBoundaries(long index, int count) {
  if (index < 0 || index + count > this.startOffset + this.valuesCount) {
    throw new ArrayIndexOutOfBoundsException();
  }
}

but index is relative to the start of the array; both call sites add startOffset to it only afterwards, e.g.

checkBoundaries(index, count);
return getArrayNoBoundCheck(
    this.dataVector, LargeMemoryUtil.checkedCastToInt(this.startOffset + index), count);

So the accepted range is too large by exactly startOffset elements, and getArray(index, count) / getResultSet(index, count) will read up to that far past the end of the row's slice.

AbstractArrowFlightJdbcListVectorAccessor builds these with the offsets of the list element being read, so any row of a list column that does not start at child offset 0 is affected. Reading within the element count the driver itself advertises then returns values belonging to other rows of the shared child vector, and past the child vector's valueCount it returns whatever is in allocated-but-unwritten memory.

Reproducer against an IntVector of 127 values, with an array covering elements 5..7:

ArrowFlightJdbcArray array = new ArrowFlightJdbcArray(dataVector, 5, 3);
array.getArray(1, 3); // accepted; returns elements 6, 7, 8 — element 8 is outside the array

Every existing test constructs the array with startOffset 0, where the wrong bound happens to coincide with the correct one, which is why this is not currently caught.