[C++] Out-of-bounds read in UriFromAbsolutePath for a non-NUL-terminated string_view #51005

arrow::util::UriFromAbsolutePath(std::string_view path) in cpp/src/arrow/util/uri.cc passes path.data() directly to uriUnixFilenameToUriStringA on the POSIX branch. That vendored routine scans its argument as a NUL-terminated C string, but a std::string_view is not required to be NUL-terminated. When the view is backed by a larger buffer (or a heap buffer with no trailing NUL), the conversion reads past the end of the view; since the output buffer was sized from path.length(), a longer run can also write past it.

The Windows branch above already avoids this by copying into a std::string first.

ASAN on a view over an exact-sized heap buffer:

==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
  #0 uriUnixFilenameToUriStringA UriFile.c
0 bytes after an 8-byte region (the view's backing buffer, no NUL)

Component(s)

C++