diff --git a/cpp/src/arrow/ipc/reader.cc b/cpp/src/arrow/ipc/reader.cc index 512305d6570..cc3b550414c 100644 --- a/cpp/src/arrow/ipc/reader.cc +++ b/cpp/src/arrow/ipc/reader.cc @@ -2293,6 +2293,14 @@ Result> ReadSparseCOOIndex( file->ReadAt(indices_buffer->offset(), indices_buffer->length(), /*allow_short_read=*/false)); std::vector indices_shape({non_zero_length, ndim}); + int64_t indices_minimum_bytes; + if (arrow::internal::MultiplyWithOverflow(non_zero_length, ndim, + &indices_minimum_bytes) || + arrow::internal::MultiplyWithOverflow(indices_minimum_bytes, indices_elsize, + &indices_minimum_bytes) || + indices_minimum_bytes > indices_buffer->length()) { + return Status::Invalid("shape is inconsistent to the size of indices buffer"); + } auto* indices_strides = sparse_index->indicesStrides(); std::vector strides(2); if (indices_strides && indices_strides->size() > 0) {