Skip to content

Commit d8da0dd

Browse files
committed
fix(cpp): resolve memory leak and out-of-bounds access in row dimensions
Signed-off-by: Durgesh Nandan Mohanty <durgeshnandanmohanty@gmail.com>
1 parent 80bcf64 commit d8da0dd

1 file changed

Lines changed: 23 additions & 7 deletions

File tree

‎cpp/fory/row/row.cc‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -232,46 +232,62 @@ void ArrayData::point_to(std::shared_ptr<Buffer> buffer, uint32_t offset,
232232
int ArrayData::calculate_header_in_bytes(int num_elements) {
233233
return 8 + ((num_elements + 63) / 64) * 8;
234234
}
235-
236235
int *ArrayData::get_dimensions(ArrayData &array, int num_dims) {
237-
// use deep-first search to search to num_dimensions-1 layer to get
238-
// dimensions.
236+
239237
int depth = 0;
240238
auto dimensions = new int[num_dims];
241239
std::vector<int> start_from_lefts(num_dims);
242240
std::vector<const ArrayData *> arrs(num_dims); // root to current node
243241
ArrayData &arr = array;
242+
244243
while (depth < num_dims) {
245244
arrs[depth] = &arr;
246245
int size = arr.num_elements();
247246
dimensions[depth] = size;
247+
248248
if (depth == num_dims - 1) {
249249
break;
250250
}
251+
251252
bool all_null = true;
252253
if (start_from_lefts[depth] == size) {
253-
// this node's subtree has all be traversed, but no node has depth count
254-
// to num_dims-1.
254+
255+
255256
start_from_lefts[depth] = 0;
256257
depth--;
258+
259+
if (depth < 0) {
260+
delete[] dimensions;
261+
return nullptr;
262+
}
257263
continue;
258264
}
265+
259266
for (int i = start_from_lefts[depth]; i < size; i++) {
260267
if (!arr.is_null_at(i)) {
261268
arr = *arr.get_array(i);
262269
all_null = false;
263270
break;
264271
}
265272
}
273+
266274
if (all_null) {
267-
// start_from_lefts[depth-1] = 0;
268-
depth--; // move up to parent node
275+
276+
depth--;
277+
278+
if (depth < 0) {
279+
delete[] dimensions;
280+
return nullptr;
281+
}
282+
269283
start_from_lefts[depth]++;
270284
arr = *arrs[depth];
271285
} else {
272286
depth++;
273287
}
288+
274289
if (depth <= 0) {
290+
delete[] dimensions;
275291
return nullptr;
276292
}
277293
}

0 commit comments

Comments
 (0)