Skip to content

GH-47924: [C++] Fix issues in CSV reader with invalid inputs#47925

Merged
pitrou merged 3 commits intoapache:mainfrom
pitrou:gh47924-csv-fuzz
Oct 28, 2025
Merged

GH-47924: [C++] Fix issues in CSV reader with invalid inputs#47925
pitrou merged 3 commits intoapache:mainfrom
pitrou:gh47924-csv-fuzz

Conversation

@pitrou
Copy link
Member

@pitrou pitrou commented Oct 23, 2025

Rationale for this change

These issues were all found by OSS-Fuzz:

Are these changes tested?

Yes, by additional fuzz regression files.

Are there any user-facing changes?

No.

This PR contains a "Critical Fix". (If the changes fix either (a) a security vulnerability, (b) a bug that caused incorrect or invalid data to be produced, or (c) a bug that causes a crash (even when the API contract is upheld), please provide explanation. If not, you can remove this.)

@pitrou pitrou force-pushed the gh47924-csv-fuzz branch 3 times, most recently from b35dc77 to 1e77d0e Compare October 23, 2025 16:15
@pitrou
Copy link
Member Author

pitrou commented Oct 23, 2025

Ouch, trying to do safe arithmetics in arrow/util/time.h includes Windows headers in all kinds of unwanted places.

I've opened #47926 so that we can hopefully find another approach.

@pitrou
Copy link
Member Author

pitrou commented Oct 27, 2025

Ouch, I hoped #47950 had fixed our problem with Windows macros but evidently it hasn't :(

@pitrou
Copy link
Member Author

pitrou commented Oct 27, 2025

@github-actions crossbow submit -g cpp

@github-actions
Copy link

Revision: fb527fc

Submitted crossbow builds: ursacomputing/crossbow @ actions-24e5081a3b

Task Status
example-cpp-minimal-build-static GitHub Actions
example-cpp-minimal-build-static-system-dependency GitHub Actions
example-cpp-tutorial GitHub Actions
test-build-cpp-fuzz GitHub Actions
test-conda-cpp GitHub Actions
test-conda-cpp-valgrind GitHub Actions
test-cuda-cpp-ubuntu-22.04-cuda-11.7.1 GitHub Actions
test-debian-12-cpp-amd64 GitHub Actions
test-debian-12-cpp-i386 GitHub Actions
test-fedora-42-cpp GitHub Actions
test-ubuntu-22.04-cpp GitHub Actions
test-ubuntu-22.04-cpp-20 GitHub Actions
test-ubuntu-22.04-cpp-bundled GitHub Actions
test-ubuntu-22.04-cpp-emscripten GitHub Actions
test-ubuntu-22.04-cpp-no-threading GitHub Actions
test-ubuntu-24.04-cpp GitHub Actions
test-ubuntu-24.04-cpp-bundled-offline GitHub Actions
test-ubuntu-24.04-cpp-gcc-13-bundled GitHub Actions
test-ubuntu-24.04-cpp-gcc-14 GitHub Actions
test-ubuntu-24.04-cpp-minimal-with-formats GitHub Actions
test-ubuntu-24.04-cpp-thread-sanitizer GitHub Actions

@pitrou pitrou added the CI: Extra: C++ Run extra C++ CI label Oct 27, 2025
@pitrou pitrou marked this pull request as ready for review October 27, 2025 18:07
Copy link
Contributor

@adamreeve adamreeve left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 looks good to me. And the failing tests are all failing on main too so are unrelated.

@github-actions github-actions bot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Oct 27, 2025
Copy link
Contributor

@HuaHuaY HuaHuaY left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me

@pitrou
Copy link
Member Author

pitrou commented Oct 28, 2025

Thanks all for the reviews!

@pitrou pitrou merged commit 88179b6 into apache:main Oct 28, 2025
44 of 47 checks passed
@pitrou pitrou removed the awaiting committer review Awaiting committer review label Oct 28, 2025
@pitrou pitrou deleted the gh47924-csv-fuzz branch October 28, 2025 09:44
@conbench-apache-arrow
Copy link

After merging your PR, Conbench analyzed the 4 benchmarking runs that have been run so far on merge-commit 88179b6.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 24 possible false positives for unstable benchmarks that are known to sometimes produce them.

zanmato1984 pushed a commit to zanmato1984/arrow that referenced this pull request Nov 5, 2025
…pache#47925)

### Rationale for this change

These issues were all found by OSS-Fuzz:
* https://issues.oss-fuzz.com/issues/452079535
* https://issues.oss-fuzz.com/issues/452079536
* https://issues.oss-fuzz.com/issues/452118314
* https://issues.oss-fuzz.com/issues/452701622
* https://issues.oss-fuzz.com/issues/452912678

### Are these changes tested?

Yes, by additional fuzz regression files.

### Are there any user-facing changes?

No.

**This PR contains a "Critical Fix".** (If the changes fix either (a) a security vulnerability, (b) a bug that caused incorrect or invalid data to be produced, or (c) a bug that causes a crash (even when the API contract is upheld), please provide explanation. If not, you can remove this.)

* GitHub Issue: apache#47924

Lead-authored-by: Antoine Pitrou <[email protected]>
Co-authored-by: Antoine Pitrou <[email protected]>
Co-authored-by: Zehua Zou <[email protected]>
Signed-off-by: Antoine Pitrou <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants