Skip to content

[C++] Unbounded memory allocation in ReadMessageContinued #55476

New issue
New issue
Open
Open
[C++] Unbounded memory allocation in ReadMessageContinued#55476
Assignees
pitrou
Labels
Component: C++Type: bug

Description

@pitrou
pitrou
opened on Nov 10, 2026

Describe the bug, including details regarding any error messages, version, and platform.

In the IPC reader, when a subset of column is asked for, we currently allocate an entire buffer with the same size as the body size advertised in the IPC message:

arrow/cpp/src/arrow/ipc/message.cc

Lines 364 to 371 in 16900e3

// Selective field loading: allocate a body buffer and read only the
// requested field ranges into it.
DCHECK_NE(file, nullptr);
ARROW_ASSIGN_OR_RAISE(
body, AllocateBuffer(decoder->next_required_size(), default_memory_pool()));
RETURN_NOT_OK(ReadFieldsSubset(offset, file, fields_loader,
SliceBuffer(metadata, 0, metadata_length),
decoder->next_required_size(), body));

Unfortunately, this can be an unbounded allocation if the advertised body size in the IPC message exceeds the file size. This opens the door to denial of service attacks.

Furthermore, the allocation uses the default memory pool instead of a user-configured memory pool.

Component(s)

C++

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Component: C++Type: bug

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions