Repository navigation
fix(deletes): validate roaring bitmap after deserialization - #1005
Merged
wgtmac merged 1 commit intoOct 15, 2026
Merged
Conversation
readSafe only bounds-checks the read and does not verify CRoaring's structural invariants. A forged deletion vector (e.g. bitset container with a wrong cardinality or wrapping run containers) could later cause out-of-bounds access during merge or serialize. Call roaring_bitmap_internal_validate right after readSafe and reject invalid bitmaps with InvalidArgument.
zhjwpku
added
the
ready to merge
wgtmac
approved these changes
Oct 15, 2026
wgtmac
left a comment
wgtmac
left a comment
Member
There was a problem hiding this comment.
LGTM. Validating the bitmap immediately after readSafe covers the only CRoaring deserialization site, so the merge (|=) and re-serialization (RunOptimize) paths are both protected, and the failure is surfaced as InvalidArgument from the existing Result API. The regression test exercises the invalid-cardinality shape; a wrapping run-container fixture would tighten coverage but is not required. Merging.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RoaringPositionBitmap::Deserializerelied onRoaring::readSafe, which only bounds-checks the read and does not verify CRoaring's structural invariants. A crafted deletion vector (e.g. a bitset container with a wrong cardinality, or wrapping run containers) could later cause out-of-bounds access during merge (|=) or serialize (runOptimize).roaring_bitmap_internal_validateright afterreadSafeand returnInvalidArgumenton failure. This is the only CRoaring deserialization site, so all read/merge paths are covered.Test plan
TestDeserializeRejectsStructurallyInvalidBitmap(bitset container claiming cardinality 4097 with all 65536 bits set); verified it fails without the fix and passes with it.util_testRoaringPositionBitmap / PositionDelete tests anddata_testpass.