[ARROW-9948] [C++] Decimal128 does not check scale range when rescaling; can cause buffer overflow

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 6.0.0, 5.0.1
• Component/s: C++
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/17339
• Assignee: Antoine Pitrou
• Reporter: Mingyu Zhong
• Created: 08/Sep/20 23:28
• Updated: 11/Jan/23 08:10
• Resolved: 03/Aug/21 10:47

Description

BasicDecimal128::GetScaleMultiplier has a DCHECK on the scale, but the scale can come from users. For example, Decimal128::FromString("1e100") will cause an out-of-bound read.

BasicDecimal128::Rescale and BasicDecimal128::GetWholeAndFraction have the same problem.

Issue Links

• links to: GitHub Pull Request #8955
• links to: GitHub Pull Request #10823