[C++][Compute] Ignore null view sizes when casting binary_view to binary

[Nayana-Naik73]

Rationale for this change

The view to offset-string cast (binary_view/utf8_view to binary, utf8, large_binary, large_utf8) reserves the output data buffer with SumOfBinaryViewSizes over every view, null slots included, and then copies each non-null value with UnsafeAppend. Views under a null bit are undefined and ValidateFull skips them, so a null view carrying a negative size (for example one read from an IPC or Parquet file) shrinks the reservation and the cast writes past the end of the output buffer. With ["foofoofoofoofoo", null, "barbarbarbarbarbarbar"] and size -36 on the null view, the array passes ValidateFull() and ASan reports a WRITE overflow in BufferBuilder::UnsafeAppend from BinaryToBinaryCastExec.

What changes are included in this PR?

The reservation now only sums the sizes of valid views, walking the validity bitmap with VisitSetBitRunsVoid.

Are these changes tested?

Yes. Cast.BinaryViewToBinaryNullViewSize builds a ValidateFull-clean utf8_view/binary_view array with a negative size on the null view and casts it to all four offset types. It fails under ASan before the change and passes after; the rest of arrow-compute-scalar-cast-test passes too.

Are there any user-facing changes?

No.

This PR contains a "Critical Fix". It fixes an out-of-bounds heap write in cast on valid input data whose null views hold a negative size.

Was AI used for this PR?

In accordance to the AI generation guidelines, please disclose below whether and how AI was used in this PR.

PR code and description written by:

• Human
• AI

Reviewed before submission by:

• Human
• AI
• Not reviewed

[github-actions]

Thanks for opening a pull request!

This pull request has been automatically converted to a draft because its title doesn't match Arrow's required format.

If this is not a minor PR, could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose

Opening GitHub issues ahead of time contributes to the Openness of the Apache Arrow project.

Then could you also rename the pull request title in the following format?

GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}

or

MINOR: [${COMPONENT}] ${SUMMARY}

After updating the title, you can mark the pull request as ready for review.

See also:

• Other pull requests
• Contribution Guidelines - Contributing Overview

[github-actions]

Thanks for opening a pull request!

This pull request has been automatically closed because you currently have 4 open pull requests, which is more than the limit of 3.

Due to the increase in pull requests opened by AI bots, and in order to keep the review queue manageable, Apache Arrow limits contributors without repository access to at most 3 concurrently open pull requests. This helps make sure each pull request gets the attention it needs and that work in progress does not go stale.

Once one of your other open pull requests has been merged or closed, you are welcome to reopen this one.

See also:

• Contribution Guidelines - Limit on concurrent pull requests
• Contribution Guidelines - Contributing Overview