Skip to content

GH-1230: fix out-of-bounds write in ClobConsumer buffer growth - #1231

Open
Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write
Open

Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write

Conversation

@Arawoof06

Copy link
Copy Markdown
Contributor

What's Changed

ClobConsumer grows the VarCharVector data buffer with a guard on dataBuffer.writerIndex() + bytes.length > capacity(), but it writes each chunk at startIndex + totalBytes through a raw MemoryUtil.copyToMemory that never advances writerIndex(), so the guard stays stuck at offset 0 and reallocDataBuffer() is never called for a CLOB whose bytes exceed the initial ~32KB allocation. The unchecked write then runs past the buffer into adjacent off-heap memory. Both consume paths now check capacity() < startIndex + totalBytes + bytes.length and re-read the buffer after a realloc, matching the sibling BinaryConsumer.

Closes #1230.

@github-actions

This comment has been minimized.

@lidavidm lidavidm added the bug-fix PRs that fix a big. label Jul 15, 2026
@github-actions github-actions Bot added this to the 20.0.0 milestone Jul 15, 2026
@Arawoof06

Copy link
Copy Markdown
Contributor Author

gentle ping

@lidavidm

Copy link
Copy Markdown
Member

@Arawoof06 please rebase

@Arawoof06
Arawoof06 force-pushed the clob-consumer-oob-write branch from 5a1bf1b to b3eb9d4 Compare August 25, 2026 11:11
@Arawoof06

Copy link
Copy Markdown
Contributor Author

Rebased onto main.

@Arawoof06
Arawoof06 force-pushed the clob-consumer-oob-write branch from b3eb9d4 to 333174d Compare October 5, 2026 19:19
@Arawoof06

Copy link
Copy Markdown
Contributor Author

Rebased onto current main again. Test/Dev/RC never started any jobs on the August push, and they're waiting on workflow approval for this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix PRs that fix a big.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBs

2 participants