GH-50314: [C++][Parquet] Reject invalid DELTA_BINARY_PACKED headers

[1fanwang]

Rationale for this change

A corrupt DELTA_BINARY_PACKED page can encode a miniblock count far larger than the page itself. The decoder allocated that buffer before discovering the input was incomplete. A single-value page never needs a miniblock buffer but still used the untrusted count.

What changes are included in this PR?

The decoder now:

• leaves the miniblock buffer unallocated for single-value pages;
• reserves the required min-delta byte before validating available bit-width bytes;
• rejects impossible headers before allocation.

Are these changes tested?

cmake --build cpp/build-review --target parquet-encoding-test -j 8
cpp/build-review/debug/parquet-encoding-test \
  --gtest_filter='*SingleValueSkipsMiniblockAllocation*:*RejectsMiniblockWidthsLargerThanInput*:*RejectsMiniblockWidthsWithoutMinDelta*'
cpp/build-review/debug/parquet-encoding-test

Raw logs

# Regression tests with the decoder fix removed
Single-value pages allocated 1048576 bytes.
Missing-min-delta pages allocated 64 bytes and raised:
Unexpected end of stream: Decode bit-width EOF
[  FAILED  ] 4 tests.

# Current branch
[==========] Running 6 tests from 2 test suites.
[  PASSED  ] 6 tests.

# Full encoding suite
[==========] Running 141 tests.
[  PASSED  ] 141 tests.

Are there any user-facing changes?

Invalid pages fail before allocation with an error that names the impossible miniblock count and available bytes. Valid single-value pages decode without allocating a miniblock buffer.

GitHub Issue: #50314

• GitHub Issue: [C++][Parquet] Reject outlandish values in DELTA_BINARY_PACKED decoder #50314

[github-actions]

⚠️ GitHub issue #50314 has been automatically assigned in GitHub to PR creator.

[Copilot]

🟡 Changes recommended

The decoder change still allocates miniblock scratch space unconditionally (including for single-value pages) and the new guard should account for required min_delta_ bytes, leaving a remaining allocation-DoS gap that should be closed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the C++ Parquet DELTA_BINARY_PACKED decoder against corrupt page headers that can otherwise drive disproportionate memory allocations and produce misleading EOF errors, aligning behavior with the security/robustness goals described in GH-50314.

Changes:

• Add header validation in DeltaBitPackDecoder::InitHeader to reject pages whose miniblock count is incompatible with the remaining input bytes and emit a more actionable ParquetException.
• Add new encoding tests to cover the single-value page path and the corrupt-header rejection case (including allocation behavior via ProxyMemoryPool).

File summaries

File	Description
cpp/src/parquet/decoder.cc	Adds early validation/error reporting for invalid DELTA_BINARY_PACKED miniblock headers (and aims to prevent oversized allocations).
cpp/src/parquet/encoding_test.cc	Adds regression tests for single-value decoding and for rejecting invalid miniblock-width headers without allocating.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ GitHub issue #50314 has been automatically assigned in GitHub to PR creator.

[Copilot]

🟢 Approval recommended

The changes directly address the allocation-before-validation issue with clear guards and are covered by focused regression tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite