Skip to content

GH-49918: [C++][Parquet] Catch std::vector allocation errors in encoding fuzzer - #49919

Merged
pitrou merged 2 commits into
apache:mainfrom
pitrou:gh49918-pq-fuzz-encoding
May 6, 2026
Merged

GH-49918: [C++][Parquet] Catch std::vector allocation errors in encoding fuzzer#49919
pitrou merged 2 commits into
apache:mainfrom
pitrou:gh49918-pq-fuzz-encoding

Conversation

@pitrou

@pitroupitrou commented May 5, 2026

Copy link
Copy Markdown
Member

Rationale for this change

The Parquet encoding fuzzer can allocate a std::vector of an arbitrary size. This can produce OOMs in the fuzzer.

Issue found by OSS-Fuzz: https://issues.oss-fuzz.com/issues/506741109

What changes are included in this PR?

  1. Use arrow::stl::allocator to delegate std::vector allocations to the fuzzing memory pool
  2. Catch any std::vector allocation exceptions and convert them to regular Status errors

Are these changes tested?

Yes, by new regression file.

Are there any user-facing changes?

No.

@pitrou
pitrou requested a review from wgtmac as a code ownerMay 5, 2026 09:20
@pitrou

Copy link
Copy Markdown
MemberAuthor

@github-actions crossbow submit -g cpp

@github-actions

Copy link
Copy Markdown

Revision: 7c9ea2f

Submitted crossbow builds: ursacomputing/crossbow @ actions-679913723d

TaskStatus
example-cpp-minimal-build-staticGitHub Actions
example-cpp-minimal-build-static-system-dependencyGitHub Actions
example-cpp-tutorialGitHub Actions
test-build-cpp-fuzzGitHub Actions
test-conda-cppGitHub Actions
test-conda-cpp-valgrindGitHub Actions
test-debian-13-cpp-amd64GitHub Actions
test-debian-13-cpp-i386GitHub Actions
test-debian-experimental-cpp-gcc-15GitHub Actions
test-fedora-42-cppGitHub Actions
test-ubuntu-22.04-cppGitHub Actions
test-ubuntu-22.04-cpp-bundledGitHub Actions
test-ubuntu-22.04-cpp-emscriptenGitHub Actions
test-ubuntu-22.04-cpp-no-threadingGitHub Actions
test-ubuntu-24.04-cppGitHub Actions
test-ubuntu-24.04-cpp-bundled-offlineGitHub Actions
test-ubuntu-24.04-cpp-gcc-13-bundledGitHub Actions
test-ubuntu-24.04-cpp-gcc-14GitHub Actions
test-ubuntu-24.04-cpp-minimal-with-formatsGitHub Actions
test-ubuntu-24.04-cpp-thread-sanitizerGitHub Actions

@pitrou
pitrou requested a review from adamreeveMay 5, 2026 10:28
allocator() noexcept : pool_(default_memory_pool()) {}
/// \brief Construct an allocator from the given MemoryPool
explicit allocator(MemoryPool* pool) noexcept : pool_(pool) {}
allocator(MemoryPool* pool) noexcept : pool_(pool) {} // NOLINT: runtime/explicit

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why explicit is removed?

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because it allows writing PoolVector<c_type> chunk_values(pool()); without having to spell out the allocator instantiation explicitly.

@github-actionsgithub-actionsBot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels May 5, 2026
@pitrou
pitrou merged commit 9d545fb into apache:mainMay 6, 2026
55 of 57 checks passed
@pitroupitrou removed the awaiting committer review Awaiting committer review label May 6, 2026
@pitrou
pitrou deleted the gh49918-pq-fuzz-encoding branch May 6, 2026 07:07
@conbench-apache-arrow

Copy link
Copy Markdown

After merging your PR, Conbench analyzed the 0 benchmarking runs that have been run so far on merge-commit 9d545fb.

None of the specified runs were found on the Conbench server.

The full Conbench report has more details.

@conbench-apache-arrow

Copy link
Copy Markdown

After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit 9d545fb.

There was 1 benchmark result with an error:

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 10 possible false positives for unstable benchmarks that are known to sometimes produce them.

Mottl pushed a commit to Mottl/arrow that referenced this pull request May 26, 2026
… encoding fuzzer (apache#49919)
### Rationale for this change
The Parquet encoding fuzzer can allocate a std::vector of an arbitrary size. This can produce OOMs in the fuzzer.
Issue found by OSS-Fuzz: https://issues.oss-fuzz.com/issues/506741109
### What changes are included in this PR?
1. Use `arrow::stl::allocator` to delegate `std::vector` allocations to the fuzzing memory pool
2. Catch any `std::vector` allocation exceptions and convert them to regular Status errors
### Are these changes tested?
Yes, by new regression file.
### Are there any user-facing changes?
No.
* GitHub Issue: apache#49918
Authored-by: Antoine Pitrou <antoine@python.org>
Signed-off-by: Antoine Pitrou <antoine@python.org>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@pitrou@wgtmac