Repository navigation
Conversation
The error message printed the input as a string starting one byte past its end. Print the six bytes that were compared instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pedrobtz
force-pushed
the
fix-ipc-footer-magic-message
branch
from
October 22, 2026 15:27
61ec299 to
3292d78
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a file does not end with
ARROW1,ArrowIpcDecoderPeekFooter()reports"Expected file to end with ARROW1 but got %s"withdata_end, which points one byte past the end of the input. The input is not NUL-terminated, so%sreads past the buffer until it finds a zero byte. The message now prints the six bytes that were compared, with%.6sonmagic.The existing
NanoarrowIpcFooterDecodingErrorscase passes a string literal, which happens to have a NUL just past its end, so it never showed the over-read. The new case copies the same ten bytes into a heap buffer of exactly that size and checks the message. Without the fix, ASan reports a heap-buffer-overflow there.Found by fuzzing the IPC reader in the zuarrow R package, which vendors nanoarrow.
ctestpasses with ASan and UBSan (409 tests). The changed files are formatted with the pinned clang-format 16.0.6.🤖 Generated with Claude Code