Skip to content

GH-47924: [C++] Fix issues in CSV reader with invalid inputs - #47925

Merged
pitrou merged 3 commits into
apache:mainfrom
pitrou:gh47924-csv-fuzz
Oct 28, 2025
Merged

GH-47924: [C++] Fix issues in CSV reader with invalid inputs#47925
pitrou merged 3 commits into
apache:mainfrom
pitrou:gh47924-csv-fuzz

Conversation

@pitrou

@pitroupitrou commented Oct 23, 2025

Copy link
Copy Markdown
Member

Rationale for this change

These issues were all found by OSS-Fuzz:

Are these changes tested?

Yes, by additional fuzz regression files.

Are there any user-facing changes?

No.

This PR contains a "Critical Fix". (If the changes fix either (a) a security vulnerability, (b) a bug that caused incorrect or invalid data to be produced, or (c) a bug that causes a crash (even when the API contract is upheld), please provide explanation. If not, you can remove this.)

@pitrou
pitrouforce-pushed the gh47924-csv-fuzz branch 3 times, most recently from b35dc77 to 1e77d0eCompareOctober 23, 2025 16:15
@pitrou

Copy link
Copy Markdown
MemberAuthor

Ouch, trying to do safe arithmetics in arrow/util/time.h includes Windows headers in all kinds of unwanted places.

I've opened #47926 so that we can hopefully find another approach.

@pitrou

Copy link
Copy Markdown
MemberAuthor

Ouch, I hoped #47950 had fixed our problem with Windows macros but evidently it hasn't :(

@pitrou

Copy link
Copy Markdown
MemberAuthor

@github-actions crossbow submit -g cpp

@github-actions

Copy link
Copy Markdown

Revision: fb527fc

Submitted crossbow builds: ursacomputing/crossbow @ actions-24e5081a3b

TaskStatus
example-cpp-minimal-build-staticGitHub Actions
example-cpp-minimal-build-static-system-dependencyGitHub Actions
example-cpp-tutorialGitHub Actions
test-build-cpp-fuzzGitHub Actions
test-conda-cppGitHub Actions
test-conda-cpp-valgrindGitHub Actions
test-cuda-cpp-ubuntu-22.04-cuda-11.7.1GitHub Actions
test-debian-12-cpp-amd64GitHub Actions
test-debian-12-cpp-i386GitHub Actions
test-fedora-42-cppGitHub Actions
test-ubuntu-22.04-cppGitHub Actions
test-ubuntu-22.04-cpp-20GitHub Actions
test-ubuntu-22.04-cpp-bundledGitHub Actions
test-ubuntu-22.04-cpp-emscriptenGitHub Actions
test-ubuntu-22.04-cpp-no-threadingGitHub Actions
test-ubuntu-24.04-cppGitHub Actions
test-ubuntu-24.04-cpp-bundled-offlineGitHub Actions
test-ubuntu-24.04-cpp-gcc-13-bundledGitHub Actions
test-ubuntu-24.04-cpp-gcc-14GitHub Actions
test-ubuntu-24.04-cpp-minimal-with-formatsGitHub Actions
test-ubuntu-24.04-cpp-thread-sanitizerGitHub Actions

@pitroupitrou added the CI: Extra: C++ Run extra C++ CI label Oct 27, 2025
@pitrou
pitrou marked this pull request as ready for review October 27, 2025 18:07

@adamreeveadamreeve left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 looks good to me. And the failing tests are all failing on main too so are unrelated.

@github-actionsgithub-actionsBot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Oct 27, 2025
Comment threadcpp/src/arrow/csv/column_builder.cc Outdated

@HuaHuaYHuaHuaY left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me

Co-authored-by: Zehua Zou <zehuazou2000@gmail.com>
@pitrou

Copy link
Copy Markdown
MemberAuthor

Thanks all for the reviews!

@pitrou
pitrou merged commit 88179b6 into apache:mainOct 28, 2025
44 of 47 checks passed
@pitroupitrou removed the awaiting committer review Awaiting committer review label Oct 28, 2025
@pitrou
pitrou deleted the gh47924-csv-fuzz branch October 28, 2025 09:44
@conbench-apache-arrow

Copy link
Copy Markdown

After merging your PR, Conbench analyzed the 4 benchmarking runs that have been run so far on merge-commit 88179b6.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 24 possible false positives for unstable benchmarks that are known to sometimes produce them.

zanmato1984 pushed a commit to zanmato1984/arrow that referenced this pull request Nov 5, 2025
…pache#47925)
### Rationale for this change
These issues were all found by OSS-Fuzz:
* https://issues.oss-fuzz.com/issues/452079535
* https://issues.oss-fuzz.com/issues/452079536
* https://issues.oss-fuzz.com/issues/452118314
* https://issues.oss-fuzz.com/issues/452701622
* https://issues.oss-fuzz.com/issues/452912678
### Are these changes tested?
Yes, by additional fuzz regression files.
### Are there any user-facing changes?
No.
**This PR contains a "Critical Fix".** (If the changes fix either (a) a security vulnerability, (b) a bug that caused incorrect or invalid data to be produced, or (c) a bug that causes a crash (even when the API contract is upheld), please provide explanation. If not, you can remove this.)
* GitHub Issue: apache#47924
Lead-authored-by: Antoine Pitrou <antoine@python.org>
Co-authored-by: Antoine Pitrou <pitrou@free.fr>
Co-authored-by: Zehua Zou <zehuazou2000@gmail.com>
Signed-off-by: Antoine Pitrou <antoine@python.org>
Mottl pushed a commit to Mottl/arrow that referenced this pull request May 26, 2026
…pache#47925)
### Rationale for this change
These issues were all found by OSS-Fuzz:
* https://issues.oss-fuzz.com/issues/452079535
* https://issues.oss-fuzz.com/issues/452079536
* https://issues.oss-fuzz.com/issues/452118314
* https://issues.oss-fuzz.com/issues/452701622
* https://issues.oss-fuzz.com/issues/452912678
### Are these changes tested?
Yes, by additional fuzz regression files.
### Are there any user-facing changes?
No.
**This PR contains a "Critical Fix".** (If the changes fix either (a) a security vulnerability, (b) a bug that caused incorrect or invalid data to be produced, or (c) a bug that causes a crash (even when the API contract is upheld), please provide explanation. If not, you can remove this.)
* GitHub Issue: apache#47924
Lead-authored-by: Antoine Pitrou <antoine@python.org>
Co-authored-by: Antoine Pitrou <pitrou@free.fr>
Co-authored-by: Zehua Zou <zehuazou2000@gmail.com>
Signed-off-by: Antoine Pitrou <antoine@python.org>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@pitrou@adamreeve@wgtmac@HuaHuaY