[ARROW-11559] [C++] Improve flatbuffers verification limits

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0
• Component/s: C++
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/27430
• Assignee: Antoine Pitrou
• Reporter: Antoine Pitrou
• Created: 08/Feb/21 18:46
• Updated: 11/Jan/23 08:20
• Resolved: 10/Feb/21 05:04

Description

See discussion in https://github.com/apache/arrow/pull/9349#issuecomment-775295349 :

Flatbuffers is able to encode a virtually unbounded of schema fields in a small buffer size. Verifying that many fields with the Flatbuffers verifier seems to result in potentially unlimited verification times, which is a denial of service risk.

The way to mitigate this risk is to pass an appropriate max_tables and/or max_depth limit to the Flatbuffers verifier.

Issue Links

• is related to: ARROW-10056 [C++] Increase flatbuffers max_tables parameter in order to read wide tables
• links to: GitHub Pull Request #57
• links to: GitHub Pull Request #9447
• links to: GitHub Pull Request #9463