arrow-parquet-oom-poc

Apache Arrow — Parquet DictDecoder OOM (CWE-789)

Target

Vulnerability

Uncontrolled Memory Allocation in DictDecoderImpl::DecodeDict()

The Parquet C++ dictionary decoder resizes an internal buffer using num_values from the DICTIONARY_PAGE page header with no validation against actual page data size. A 504-byte malicious Parquet file with a forged num_values = 134,217,727 triggers Resize(1,073,741,816) (~1 GB) → DoS crash.

cpp/src/parquet/decoder.cc — DictDecoderImpl::DecodeDict()

  dictionary_length_ = static_cast<int32_t>(dictionary->values_left());
  // ↑ values_left() = num_values from page header — no bounds check
  dictionary_->Resize(static_cast<int64_t>(dictionary_length_) * sizeof(T));
  // ↑ UNBOUNDED ALLOC — 134M values × 8 bytes = 1 GB

Root Cause Snippet

DICTIONARY_PAGE Thrift header: num_values = 134,217,727  (4-byte varint: FE FF FF 7F)
                                actual data = 24 bytes
CheckNumValuesInHeader():       passes (only rejects negatives)
DictDecoderImpl::DecodeDict():  Resize(134,217,727 × 8 = 1,073,741,816)  ← CRASH

Trigger Path (3 steps)

pip install pyarrow
ulimit -v 524288
python3 poc_arrow_dict.py

Expected output

[+] MemoryError: malloc of size 1073741824 failed
[+] DictDecoderImpl::DecodeDict triggered unbounded allocation!
[+] CWE-789: Uncontrolled Memory Allocation — CONFIRMED

Files

Relationship to GH-49955

GH-49955 / PR #49954 fixed CWE-789 in the Delta decoder family. The dictionary decoder path (DictDecoderImpl::DecodeDict) was not included and has the identical root cause. This is a distinct, unpatched variant.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH

---

Reported 2026-05-31 | Eric Gachara