Repository navigation
[Security] Clamp file-controlled bit_width in cencoding RLE decode (SIGSEGV, fixes #985) - #989
Open
plotarmordev wants to merge 1 commit into
Open
plotarmordev wants to merge 1 commit into
plotarmordev wants to merge 1 commit into
Conversation
bit_width for RLE/PLAIN_DICTIONARY columns comes from schema type_length and was passed unvalidated into the cencoding RLE decode (boundscheck=False). A crafted parquet with a huge type_length + short page caused SIGSEGV in read_rle (OOB read/write). Clamp to the 64-bit max here before decoding. Verified: crafted repro no longer crashes (3x) on a patched install; normal files unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ties to #985: bit_width from schema type_length is file-controlled, passed unvalidated into the boundscheck=False Cython RLE decode; a crafted parquet with huge type_length segfaults (exit 139). Clamp [1,64] before decode; verified 3x-cured locally, no regression on normal files.