From ed86fa2408cb8d88384009ef1f34e4a7cd7a7db4 Mon Sep 17 00:00:00 2001 From: metsw24-max Date: Tue, 2 Jun 2026 11:00:53 +0530 Subject: [PATCH] GH-50075: [C++][Gandiva] fix buffer overrun in to_hex int32/int64 --- cpp/src/gandiva/precompiled/string_ops.cc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/cpp/src/gandiva/precompiled/string_ops.cc b/cpp/src/gandiva/precompiled/string_ops.cc index 035d3c8c62e1..b5ad558a7670 100644 --- a/cpp/src/gandiva/precompiled/string_ops.cc +++ b/cpp/src/gandiva/precompiled/string_ops.cc @@ -2857,8 +2857,9 @@ const char* to_hex_binary(int64_t context, const char* text, int32_t text_len, FORCE_INLINE const char* to_hex_int64(int64_t context, int64_t data, int32_t* out_len) { const int64_t hex_long_max_size = 2 * sizeof(int64_t); - auto ret = - reinterpret_cast(gdv_fn_context_arena_malloc(context, hex_long_max_size)); + // Allocate one extra byte for the null terminator written by snprintf. + auto ret = reinterpret_cast( + gdv_fn_context_arena_malloc(context, hex_long_max_size + 1)); if (ret == nullptr) { gdv_fn_context_set_error_msg(context, "Could not allocate memory for output string"); @@ -2874,7 +2875,8 @@ const char* to_hex_int64(int64_t context, int64_t data, int32_t* out_len) { FORCE_INLINE const char* to_hex_int32(int64_t context, int32_t data, int32_t* out_len) { const int32_t max_size = 2 * sizeof(int32_t); - auto ret = reinterpret_cast(gdv_fn_context_arena_malloc(context, max_size)); + // Allocate one extra byte for the null terminator written by snprintf. + auto ret = reinterpret_cast(gdv_fn_context_arena_malloc(context, max_size + 1)); if (ret == nullptr) { gdv_fn_context_set_error_msg(context, "Could not allocate memory for output string");