From 6948e8723a519a5fa29fca9404aad14358f55c0b Mon Sep 17 00:00:00 2001 From: Nayana Naik Date: Fri, 16 Oct 2026 13:58:59 +0530 Subject: [PATCH] MINOR: [C++] Reject negative array offset in ArrayData validation --- cpp/src/arrow/array/array_test.cc | 8 ++++++++ cpp/src/arrow/array/validate.cc | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/cpp/src/arrow/array/array_test.cc b/cpp/src/arrow/array/array_test.cc index 2cdf94bfab95..53e18e965ba8 100644 --- a/cpp/src/arrow/array/array_test.cc +++ b/cpp/src/arrow/array/array_test.cc @@ -1188,6 +1188,14 @@ TEST_F(TestArray, ValidateBuffersPrimitive) { data = ArrayData::Make(int64(), 2, {null_buffer, data_buffer}, kUnknownNullCount, 1); array = MakeArray(data); ASSERT_RAISES(Invalid, array->Validate()); + + // Negative offset. The buffer-size checks use length + offset, so a negative + // offset that cancels the length would otherwise accept too-small buffers and + // leave reads of Value(i) addressing before the buffer. + data = ArrayData::Make(int64(), 2, {null_buffer, data_buffer}, kUnknownNullCount, -2); + array = MakeArray(data); + ASSERT_RAISES(Invalid, array->Validate()); + ASSERT_RAISES(Invalid, array->ValidateFull()); } // ---------------------------------------------------------------------- diff --git a/cpp/src/arrow/array/validate.cc b/cpp/src/arrow/array/validate.cc index 16bc9187af46..42c35b637134 100644 --- a/cpp/src/arrow/array/validate.cc +++ b/cpp/src/arrow/array/validate.cc @@ -478,6 +478,10 @@ struct ValidateArrayImpl { return Status::Invalid("Array length is negative"); } + if (data.offset < 0) { + return Status::Invalid("Array offset is negative"); + } + if (layout.variadic_spec) { if (data.buffers.size() < layout.buffers.size()) { return Status::Invalid("Expected at least ", layout.buffers.size(),