Skip to content

ORC-2190: [C++] Reject compressed chunk length exceeding block size in C++ reader#2671

Draft
dongjoon-hyun wants to merge 1 commit into
apache:mainfrom
dongjoon-hyun:ORC-2190
Draft

ORC-2190: [C++] Reject compressed chunk length exceeding block size in C++ reader#2671
dongjoon-hyun wants to merge 1 commit into
apache:mainfrom
dongjoon-hyun:ORC-2190

Conversation

@dongjoon-hyun

Copy link
Copy Markdown
Member

What changes were proposed in this pull request?

This PR makes the ORC C++ reader reject a compressed chunk whose length exceeds the configured
compression block size, matching the Java reader.

if (chunkLength > bufferSize) {
throw new IllegalArgumentException("Buffer size too small. size = " +
bufferSize + " needed = " + chunkLength + " in " + name);
}

Why are the changes needed?

The Java reader already performs this check in InStream.CompressedStream.readHeader, but the C++
reader was missing it. This is a defense-in-depth hardening (not a CVE): the chunk length is already
bounded to ~8MB by the 3-byte header, but the spec-mandated first check was absent on the C++ side.
Well-formed files are unaffected.

How was this patch tested?

Pass the CIs with the newly added test case.

Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Fable 5

@dongjoon-hyun dongjoon-hyun marked this pull request as draft July 7, 2026 07:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant