Skip to content

fix(array): guard BinaryViewBuilder size checks#888

Merged
zeroshade merged 1 commit into
apache:mainfrom
fallintoplace:fix-binary-view-builder-size-guard
Jul 4, 2026
Merged

fix(array): guard BinaryViewBuilder size checks#888
zeroshade merged 1 commit into
apache:mainfrom
fallintoplace:fix-binary-view-builder-size-guard

Conversation

@fallintoplace

Copy link
Copy Markdown
Contributor

What changed

BinaryViewBuilder now checks view value lengths as int before any narrowing conversion to int32. Both ReserveData and Append use the same size guard.

The regression test covers oversized ReserveData lengths and oversized byte slices without allocating multi-gigabyte buffers.

Why

The previous check converted lengths to int32 before comparison. Values larger than math.MaxInt32 could wrap negative and bypass the 2GB guard.

Validation

  • go test ./arrow/array -run 'TestBinaryViewBuilderRejectsOversizedValues|TestBinaryViewStringRoundTrip'
  • go test ./arrow/array
  • go test ./arrow/...
  • go test -tags assert ./arrow/array

@fallintoplace fallintoplace requested a review from zeroshade as a code owner July 2, 2026 18:48
Comment thread arrow/array/binarybuilder.go Outdated
func (b *BinaryViewBuilder) ReserveData(length int) {
if int32(length) > viewValueSizeLimit {
func checkBinaryViewValueSize(length int) {
if length > int(viewValueSizeLimit) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the concern is wrapping past the int32 max value, this should be explicitly int64(viewValueSizeLimit) instead of just int so that it is correct on 32-bit systems also.

@fallintoplace fallintoplace force-pushed the fix-binary-view-builder-size-guard branch 2 times, most recently from 7d9d3f9 to 6df0038 Compare July 4, 2026 00:26

@zeroshade zeroshade left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks — extracting checkBinaryViewValueSize(length int64) addresses my earlier note: the comparison is now done in int64 (length > int64(viewValueSizeLimit)), so the previous int32(length) truncation on 64-bit is gone and Append/ReserveData share one guard. TestBinaryViewBuilderRejectsOversizedValues (size-guard + ReserveData, the latter correctly skipped on 32-bit) passes locally. LGTM.

Heads-up: #895 reuses the binaryViewNoAllocAllocator helper this PR introduces, so this one should merge first.

@zeroshade zeroshade merged commit bfe1030 into apache:main Jul 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants