Skip to content

[C++] Null pointer arithmetic in Buffer and MutableBuffer slicing constructors #55445

Open

Description

@atharva-potdar

Describe the bug, including details regarding any error messages, version, and platform.

Currently, the slicing constructors for Buffer (cpp/src/arrow/buffer.h) and MutableBuffer (cpp/src/arrow/buffer.cc) unconditionally add offset to the parent buffer's pointer/address:

// cpp/src/arrow/buffer.h
Buffer(std::shared_ptr<Buffer> parent, const int64_t offset, const int64_t size)
    : Buffer(parent->data_ + offset, size) { ... }

// cpp/src/arrow/buffer.cc
MutableBuffer::MutableBuffer(const std::shared_ptr<Buffer>& parent, const int64_t offset,
                             const int64_t size)
    : MutableBuffer(reinterpret_cast<uint8_t*>(parent->mutable_address()) + offset,
                    size) { ... }

When slicing a null-backed buffer where parent->data_ is nullptr or parent->mutable_address() is 0 with a non-zero offset (e.g., SliceBuffer(std::make_shared<Buffer>(nullptr, 16), 8, 8)):

  1. It performs undefined pointer arithmetic on a null pointer ([expr.add]), producing a non-null corrupted address (0x8 instead of nullptr).
  2. It triggers clang-analyzer-core.NullPointerArithm in clang-tidy:
cpp/src/arrow/buffer.cc:167:75: warning: Addition of a null pointer and a nonzero integer value (from variable 'offset') results in undefined behavior [clang-analyzer-core.NullPointerArithm]

Component(s)

C++

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions