JonSnow1807 opened a new issue, #54937:
URL: https://github.com/apache/arrow/issues/54937
### Describe the bug, including details regarding any error messages,
version, and platform.
`DenseUnionArray::Make(type_ids, value_offsets, children, ...)` builds the
union from the raw buffers of `type_ids` and `value_offsets` and uses
`type_ids.offset()` as the offset of the union array for both buffers. The
offset and the length of `value_offsets` are never looked at, so:
- If `value_offsets` is sliced differently from `type_ids`, the union reads
the value offsets from the wrong positions. `ValidateFull()` does not notice
because the offsets that are read are still valid offsets into the children.
- If `value_offsets` is shorter than `type_ids`, `Make` succeeds and the
union reads past the logical end of `value_offsets` (into whatever the backing
buffer holds).
Reproducer (C++, current main 373d64c):
```cpp
auto type_ids = ArrayFromJSON(int8(), "[0, 0]");
auto child = ArrayFromJSON(int64(), "[10, 20, 30]");
auto value_offsets = ArrayFromJSON(int32(), "[0, 1, 2]")->Slice(1, 2); //
logically [1, 2]
auto arr = DenseUnionArray::Make(*type_ids, *value_offsets,
{child}).ValueOrDie();
// expected [20, 30], actual [10, 20]; arr->ValidateFull() is OK
auto short_offsets = ArrayFromJSON(int32(), "[0, 1]")->Slice(0, 1); //
length 1
DenseUnionArray::Make(*type_ids, *short_offsets, {child}); //
succeeds, should be Invalid
```
Same root cause as GH-54907 (`SparseUnionArray::Make` and sliced
`type_ids`), found while fixing that issue. Proposed fix: reject a
`value_offsets` array shorter than `type_ids` and slice both buffers to their
logical windows (zero-copy) so the union can be built with offset 0.
### Component(s)
C++
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
