arrow-decompress-parquet-oom-poc

Apache Arrow — Parquet DecompressIfNeeded OOM (CWE-789)

Target

Vulnerability

Uncontrolled Memory Allocation in SerializedPageReader::DecompressIfNeeded()

The Parquet C++ decompression path resizes an internal buffer using uncompressed_page_size from the page header with no upper bound validation. A 595-byte SNAPPY-compressed Parquet file with a forged uncompressed_page_size = INT32_MAX triggers Resize(2,147,483,647) — a 2 GB allocation — before any decompression is attempted.

cpp/src/parquet/column_reader.cc — SerializedPageReader::DecompressIfNeeded()

  if (compressed_len < 0 || uncompressed_len < 0) ...  // ONLY check: negatives
  decompression_buffer_->Resize(uncompressed_len, false);  // <- UNBOUNDED ALLOC

Note: column_writer.cc:288 validates this on the write side. The reader has no matching check — a classic read/write asymmetry.

Root Cause Snippet

DATA_PAGE Thrift header: uncompressed_page_size = 2,147,483,647  (5-byte varint: FE FF FF FF 0F)
                          compressed_page_size   = 139            (139 actual bytes)
Validation:               if (uncompressed_len < 0) → PASSES (2,147,483,647 is positive)
DecompressIfNeeded():     decompression_buffer_->Resize(2,147,483,647)  ← CRASH

Binary Patch (2 bytes changed, 3 bytes inserted)

The two patches cancel out in the stream budget — total_compressed_size in the footer is unchanged, no offset errors.

Reproduction

pip install pyarrow
ulimit -v 524288
python3 poc_arrow_decompress.py

Expected output

[+] MemoryError: malloc of size 2147483648 failed
[+] DecompressIfNeeded triggered unbounded Resize(2,147,483,647)!
[+] CWE-789: Uncontrolled Memory Allocation — CONFIRMED

Files

Difference from Finding #1 (Dict Decoder)

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH

---

Reported 2026-05-31 | Eric Gachara