Skip to content

GH-50351 : [C++] KeyValueMetadata::DeleteMany method crashes#50500

Open
dkp116 wants to merge 3 commits into
apache:mainfrom
dkp116:GH-50351
Open

GH-50351 : [C++] KeyValueMetadata::DeleteMany method crashes#50500
dkp116 wants to merge 3 commits into
apache:mainfrom
dkp116:GH-50351

Conversation

@dkp116

@dkp116 dkp116 commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Rationale for this change

Investigated the two usages of DeleteMany in the codebase to verify whether there could be an issue caused by incorrect or duplicate indexes being passed.

There are two locations where DeleteMany is called:

  1. cpp/src/arrow/c/bridge.cc
DeleteMany(metadata_.extension_name_index, metadata_.extension_serialized_index)

The indexes are populated while iterating through metadata keys:

if (keys[i] == kExtensionTypeKeyName) {
  decoded.extension_name = values[i];
  decoded.extension_name_index = i;
} else if (keys[i] == kExtensionMetadataKeyName) {
  decoded.extension_serialized = values[i];
  decoded.extension_serialized_index = i;
}

Here due to the if and else if statement there is not a case where they are the same value.

  1. cpp/src/arrow/ipc/metadata_internal.cc
metadata->DeleteMany({name_index, data_index});

Here, the indexes are obtained using:

name_index = metadata->FindKey(kExtensionTypeKeyName);
data_index = metadata->FindKey(kExtensionMetadataKeyName);

FindKey traverses the keys_ array maintained by KeyValueMetadata and returns the index of the matching key. Since the two searched keys are different:

cpp/src/arrow/extension_type.cc

extern const char kExtensionTypeKeyName[] = "ARROW:extension:name";
extern const char kExtensionMetadataKeyName[] = "ARROW:extension:metadata";

the returned indexes refer to two different metadata entries.

What changes are included in this PR?

This change documents/investigates the behavior of the existing DeleteMany, and a log is produced when DeleteMany is accessing an invalid memory address instead of throwing with this error:
/usr/include/c++/16.1.1/bits/stl_vector.h:1253: constexpr std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::operator [with _Tp = std::__cxx11::basic_string; _Alloc = std::allocator<std::__cxx11::basic_string >;
reference = std::__cxx11::basic_string&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

Note: I have not prevented the use of the same index in DeleteMany as for example DeleteMany(1,1) will still give an output, given a valid key and array vector so no functionality has been changed, just a more readable log has been added.

Are these changes tested?

A test has been added to cpp/src/arrow/util/key_value_metadata_test.cc which checks to see the correct error is shown when an invalid memory address is being accessed

Are there any user-facing changes?

No user-facing changes.

@dkp116 dkp116 requested a review from pitrou as a code owner July 13, 2026 17:07
@github-actions

Copy link
Copy Markdown

Thanks for opening a pull request!

If this is not a minor PR. Could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose

Opening GitHub issues ahead of time contributes to the Openness of the Apache Arrow project.

Then could you also rename the pull request title in the following format?

GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}

or

MINOR: [${COMPONENT}] ${SUMMARY}

See also:

@dkp116 dkp116 changed the title GH 50351 - KeyValueMetadata::DeleteMany method crashes GH-50351 : KeyValueMetadata::DeleteMany method crashes Jul 13, 2026
@dkp116 dkp116 changed the title GH-50351 : KeyValueMetadata::DeleteMany method crashes GH-50351 : [C++] KeyValueMetadata::DeleteMany method crashes Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant