Skip to content

[C++] Signed integer overflow in Decimal FromString exponent handling #50057

@metsw24-max

Description

@metsw24-max

Decimal{32,64,128,256}::FromString parse the exponent with ParseValue<Int32Type>, so it can be any int32_t including INT32_MIN. DecimalFromString/SimpleDecimalFromString in cpp/src/arrow/util/decimal.cc then compute parsed_scale = -adjusted_exponent + fractional_digits. For an input like 0E-2147483648 the negation of INT32_MIN is signed-integer-overflow UB; a near-INT32_MIN exponent overflows the addition.

UBSan on the expression:

decimal.cc: runtime error: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int')

These are public string-parsing entry points reachable from the CSV/JSON readers when converting decimal columns, so the input crosses a trust boundary.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions