MINOR: [c++] reject lone low surrogate U+DFFF in JSON decoder#3841
Open
arib06 wants to merge 1 commit into
Open
MINOR: [c++] reject lone low surrogate U+DFFF in JSON decoder#3841arib06 wants to merge 1 commit into
arib06 wants to merge 1 commit into
Conversation
The lone-surrogate check used an exclusive upper bound (n < 0xdfff), so the last low surrogate U+DFFF slipped through and was emitted as the invalid UTF-8 sequence ED BF BF; make the bound inclusive to match the trailing-surrogate validation in the same function.
thiru-mg
reviewed
Jul 10, 2026
martin-g
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of the change
JsonParser::decodeStringrejects unpaired low surrogates, but the range check uses an exclusive upper bound (n >= 0xdc00 && n < 0xdfff), so the last low surrogate U+DFFF is not caught. It falls through and is emitted as the 3-byte sequenceED BF BF, which is not valid UTF-8 (it encodes a surrogate half). Every other lone low surrogate (U+DC00..U+DFFE) is already rejected. The trailing-surrogate check a few lines above already treats U+DFFF as a valid low surrogate (m > 0xdfff), so the lone-surrogate branch is off by one. This makes the bound inclusive so U+DFFF is rejected consistently.Verifying this change
This change added tests and can be verified as follows:
\udfff, is rejected. It fails on the current code (U+DFFF is accepted) and passes with the fix.Documentation