[ORC-403] Should check offsets got from protobuf Objects

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.3, 1.6.0
• Component/s: C++
• Assignee: Quanlong Huang
• Reporter: Quanlong Huang
• Created: 15/Sep/18 10:29
• Updated: 26/Sep/18 00:21
• Resolved: 18/Sep/18 23:21

Description

A malformed ORC file may have a postscript length larger than the file size, which causes orc:: readPostscript to read unexpected data.

    std::unique_ptr<proto::PostScript> postscript =
      std::unique_ptr<proto::PostScript>(new proto::PostScript());
    if (!postscript->ParseFromArray(ptr + readSize - 1 - postscriptSize,
                                   static_cast<int>(postscriptSize))) {
      throw ParseError("Failed to parse the postscript from " +
                       stream->getName());
    }

We should make sure readSize - 1 - postscriptSize >= 0. Furthermore, we should check offsets and lengths got from protobuf Objects.

Issue Links

• is related to: IMPALA-6772 Enable test_scanners_fuzz for ORC format
• links to: GitHub Pull Request #309