[ARROW-12077] [C++] Out-of-bounds write in ListArray::FromArrays

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0
• Fix Version/s: 4.0.0
• Component/s: C++
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/27902
• Assignee: David Li
• Reporter: David Li
• Created: 24/Mar/21 20:14
• Updated: 11/Jan/23 08:24
• Resolved: 25/Mar/21 17:41

Description

This crashes when the batch is dropped with the error mimalloc: error: buffer overflow in heap block 0000040000001A00 of size 512: write after 512 bytes

auto batch_schema = schema({field("list", list(float64()), true), field("f64", float64())});
auto batch = random::GenerateBatch(batch_schema->fields(), /*batch_size=*/4096, /*seed=*/0);

Notably all the following are required:

• The list column must be nullable
• The float column must be present
• The batch size must be at least 4096
• Must be release mode (RelWithDebInfo does not crash)
• Must be built in a similar way as AppVeyor (i.e. following http://arrow.apache.org/docs/developers/cpp/windows.html#replicating-appveyor-builds)

Issue Links

• links to: GitHub Pull Request #9801