diff --git a/cpp/src/arrow/ipc/reader.cc b/cpp/src/arrow/ipc/reader.cc index 5dd01f2015dd7..a60375acb420a 100644 --- a/cpp/src/arrow/ipc/reader.cc +++ b/cpp/src/arrow/ipc/reader.cc @@ -254,7 +254,12 @@ class ArrayLoader { if (i >= static_cast(variadic_counts->size())) { return Status::IOError("variadic_count_index out of range."); } - return static_cast(variadic_counts->Get(i)); + int64_t count = variadic_counts->Get(i); + if (count < 0 || count > std::numeric_limits::max()) { + return Status::IOError( + "variadic_count must be represenable as a positive int32_t, got ", count, "."); + } + return static_cast(count); } Status GetFieldMetadata(int field_index, ArrayData* out) { @@ -372,10 +377,10 @@ class ArrayLoader { RETURN_NOT_OK(LoadCommon(type.id())); RETURN_NOT_OK(GetBuffer(buffer_index_++, &out_->buffers[1])); - ARROW_ASSIGN_OR_RAISE(auto character_buffer_count, + ARROW_ASSIGN_OR_RAISE(auto data_buffer_count, GetVariadicCount(variadic_count_index_++)); - out_->buffers.resize(character_buffer_count + 2); - for (size_t i = 0; i < character_buffer_count; ++i) { + out_->buffers.resize(data_buffer_count + 2); + for (size_t i = 0; i < data_buffer_count; ++i) { RETURN_NOT_OK(GetBuffer(buffer_index_++, &out_->buffers[i + 2])); } return Status::OK();