Skip to content

Commit 935868a

Browse files
Fix OOB column-chunk access when chunkRemaining hits zero (#732)
Summary: Pull Request resolved: #732 Add a bounds check immediately after the chunk-advance so that a malformed input which lands `chunkIdx` past the end of the column-chunk vector is rejected with `node_invalid_input` instead of aborting. Reviewed By: terrelln Differential Revision: D103844843 fbshipit-source-id: 270fe012bb9f87d9fe756e2d50ea63206877d7d5
1 parent 6959466 commit 935868a

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

custom_parsers/parquet/parquet_lexer.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,10 @@ lexOne(ZL_ParquetLexer* lexer, ZL_ParquetToken* out, ZL_ErrorContext* errCtx)
272272
ZL_ERR_IF_LT(chunkRemaining, 0, node_invalid_input);
273273
ZL_ERR_IF_LT(
274274
getRemaining(lexer), (size_t)chunkRemaining, node_invalid_input);
275+
ZL_ERR_IF_GE(
276+
lexer->chunkIdx,
277+
lexer->fileMetadata->columnChunks.size(),
278+
node_invalid_input);
275279

276280
if (!lexer->pageHeader) {
277281
return lexPageHeader(lexer, out, errCtx);

0 commit comments

Comments
 (0)