Skip to content

Conversation

mhilton
Copy link
Contributor

@mhilton mhilton commented Aug 7, 2025

An empty arrow.TableBuffer can panic when calling Len() if it is in the process of being appended to by a table.BufferBuilder. Normally the TableBuffer maintains the invariant that the size of Columns is the same as the size if Values so to check one is equivalent to checkint the other. However when a BufferBuilder is merging buffers with different schema it will add new null-valued columns to the TableBuffer. This checks the TableBuffer.Len() between adding the column and adding the null-valued column.

In the case that the TableBuffer is empty, but the Columns array is a zero-length slice, rather than nil, a panic occurs.

There are two fixes here. Either of which fix the symptom, but both are worthwhile changes. TableBuffer.Len() now checks the length of the slice it is attempting to access before reading it.
BufferBuilder.normalizeSchema() now checks that the Columns slice length is 0 (rather than the value being nil) in order to use the shortcut normalize code path.

Checklist

Dear Author 👋, the following checks should be completed (or explicitly dismissed) before merging.

  • ✏️ Write a PR description, regardless of triviality, to include the value of this PR
  • 🔗 Reference related issues
  • 🏃 Test cases are included to exercise the new code
  • 🧪 If new packages are being introduced to stdlib, link to Working Group discussion notes and ensure it lands under experimental/
  • 📖 If language features are changing, ensure docs/Spec.md has been updated

Dear Reviewer(s) 👋, you are responsible (among others) for ensuring the completeness and quality of the above before approval.

An empty arrow.TableBuffer can panic when calling Len() if it is in the
process of being appended to by a table.BufferBuilder. Normally the
TableBuffer maintains the invariant that the size of Columns is the same
as the size if Values so to check one is equivalent to checkint the
other. However when a BufferBuilder is merging buffers with different
schema it will add new null-valued columns to the TableBuffer. This
checks the TableBuffer.Len() between adding the column and adding the
null-valued column.

In the case that the TableBuffer is empty, but the Columns array is a
zero-length slice, rather than nil, a panic occurs.

There are two fixes here. Either of which fix the symptom, but both are
worthwhile changes. TableBuffer.Len() now checks the length of the slice
it is attempting to access before reading it.
BufferBuilder.normalizeSchema() now checks that the Columns slice length
is 0 (rather than the value being nil) in order to use the shortcut
normalize code path.
@mhilton mhilton self-assigned this Aug 7, 2025
@mhilton mhilton requested a review from a team as a code owner August 7, 2025 08:41
@mhilton mhilton merged commit 9edfdfa into master Aug 7, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants