Skip to content

GH-1230: fix out-of-bounds write in ClobConsumer buffer growth - #1231

Open
Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write
Open

GH-1230: fix out-of-bounds write in ClobConsumer buffer growth#1231
Arawoof06 wants to merge 1 commit into
apache:mainfrom
Arawoof06:clob-consumer-oob-write

Conversation

@Arawoof06

Copy link
Copy Markdown
Contributor

What's Changed

ClobConsumer grows the VarCharVector data buffer with a guard on dataBuffer.writerIndex() + bytes.length > capacity(), but it writes each chunk at startIndex + totalBytes through a raw MemoryUtil.copyToMemory that never advances writerIndex(), so the guard stays stuck at offset 0 and reallocDataBuffer() is never called for a CLOB whose bytes exceed the initial ~32KB allocation. The unchecked write then runs past the buffer into adjacent off-heap memory. Both consume paths now check capacity() < startIndex + totalBytes + bytes.length and re-read the buffer after a realloc, matching the sibling BinaryConsumer.

Closes #1230.

@github-actions

This comment has been minimized.

@lidavidm lidavidm added the bug-fix PRs that fix a big. label Jul 15, 2026
@github-actions github-actions Bot added this to the 20.0.0 milestone Jul 15, 2026
@Arawoof06

Copy link
Copy Markdown
Contributor Author

gentle ping

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix PRs that fix a big.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Java][JDBC] ClobConsumer writes past VarCharVector data buffer for large CLOBs

2 participants