arrow::util::UriFromAbsolutePath(std::string_view path) in cpp/src/arrow/util/uri.cc passes path.data() directly to uriUnixFilenameToUriStringA on the POSIX branch. That vendored routine scans its argument as a NUL-terminated C string, but a std::string_view is not required to be NUL-terminated. When the view is backed by a larger buffer (or a heap buffer with no trailing NUL), the conversion reads past the end of the view; since the output buffer was sized from path.length(), a longer run can also write past it.
The Windows branch above already avoids this by copying into a std::string first.
ASAN on a view over an exact-sized heap buffer:
==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
#0 uriUnixFilenameToUriStringA UriFile.c
0 bytes after an 8-byte region (the view's backing buffer, no NUL)
Component(s)
C++
arrow::util::UriFromAbsolutePath(std::string_view path)incpp/src/arrow/util/uri.ccpassespath.data()directly touriUnixFilenameToUriStringAon the POSIX branch. That vendored routine scans its argument as a NUL-terminated C string, but astd::string_viewis not required to be NUL-terminated. When the view is backed by a larger buffer (or a heap buffer with no trailing NUL), the conversion reads past the end of the view; since the output buffer was sized frompath.length(), a longer run can also write past it.The Windows branch above already avoids this by copying into a
std::stringfirst.ASAN on a view over an exact-sized heap buffer:
Component(s)
C++