-
Notifications
You must be signed in to change notification settings - Fork 4k
Closed
Description
This is my first time creating an issue, so please let me know if I need to do anything differently.
There are a few soundness issues with the methods currently available on Buffer.
- Using a combination of
from_raw_partsanddata/as_ref, e.g.Buffer::from_raw_parts(ptr, len).data(), it's possible to dereference arbitrary memory locations, break pointer aliasing rules, etc. To fix this,from_raw_partsneeds to beunsafe, and the safety requirements onptrandlenshould be specified. (For an example of a similar method in the standard library, seestd::slice::from_raw_parts.) - By implementing the
ArrowNativeTypetrait on a struct, it's possible for a user to create invalid values of that struct using thetyped_datamethod. To fix this, theArrowNativeTypetrait needs to beunsafe, or users need to be prevented from implementingArrowNativeTypeon arbitrary types. Alternatively, thetyped_datamethod could be made unsafe. - It's possible to create invalid values of the
booltype usingtyped_data. (Values ofboolmust be0x00or0x01; arbitraryu8cannot safely be reinterpreted asbool.) To fix this,typed_data::<bool>()needs to iterate over all the data and check that all the elements are valid, ortyped_dataneeds to be markedunsafe.
Reporter: Jim Turner
Assignee: Paddy Horan / @paddyhoran
PRs and other links:
Note: This issue was originally created as ARROW-7624. Please see the migration documentation for further details.