Repository navigation
Commit abd96ca
committed
fix: memory corruption due to accessing out of bounds output vector index
In numpy_scan.cpp, the OBJECT/STRING scan path uses pos = i +
offset (the absolute row index in the source array) as the output
vector index for setNull() when handling None or NaN values:
```cpp
// BEFORE (buggy):
outputVector->setNull(pos, true /* isNull */); // pos = i + offset
```
The output vector is sized for DEFAULT_VECTOR_CAPACITY (= 2048)
entries and expects 0-based indices within each batch. But pos is
the absolute dataframe row index. When the COPY spans multiple
batches (i.e., when offset >= DEFAULT_VECTOR_CAPACITY), pos exceeds
the null mask buffer, causing a heap buffer overrun → the segfault
/ free(): invalid next size / munmap_chunk(): invalid pointer
crashes seen on Linux.1 parent 2a28669 commit abd96ca
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
172 | 172 | | |
173 | 173 | | |
174 | 174 | | |
175 | | - | |
| 175 | + | |
176 | 176 | | |
177 | 177 | | |
178 | 178 | | |
| |||
0 commit comments