Skip to content

GH-1230: fix out-of-bounds write in ClobConsumer buffer growth#1231

Open
Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write
Open

GH-1230: fix out-of-bounds write in ClobConsumer buffer growth#1231
Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write

Conversation

@Arawoof06

Copy link
Copy Markdown
Contributor

What's Changed

ClobConsumer grows the VarCharVector data buffer with a guard on dataBuffer.writerIndex() + bytes.length > capacity(), but it writes each chunk at startIndex + totalBytes through a raw MemoryUtil.copyToMemory that never advances writerIndex(), so the guard stays stuck at offset 0 and reallocDataBuffer() is never called for a CLOB whose bytes exceed the initial ~32KB allocation. The unchecked write then runs past the buffer into adjacent off-heap memory. Both consume paths now check capacity() < startIndex + totalBytes + bytes.length and re-read the buffer after a realloc, matching the sibling BinaryConsumer.

Closes #1230.

@github-actions

This comment has been minimized.

@lidavidm lidavidm added the bug-fix PRs that fix a big. label Jul 15, 2026
@github-actions github-actions Bot added this to the 20.0.0 milestone Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix PRs that fix a big.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBs

2 participants