[VL] Validate parquet field ids on the Iceberg write path - #12956
Draft
malinjawi wants to merge 1 commit into
Draft
[VL] Validate parquet field ids on the Iceberg write path#12956malinjawi wants to merge 1 commit into
malinjawi wants to merge 1 commit into
Conversation
IcebergWriter trusted the incoming field-id proto and indexed it positionally, so a proto that disagreed with the Velox row type was an out-of-bounds read rather than an error. Velox only checks arity shallowly and stops recursing at non-ROW array elements, so ARRAY<ARRAY<T>> and ARRAY<MAP<K,V>> reach an unguarded .at(0) inside Velox instead of a diagnostic. Add a shared resolver that validates a decoded field-id tree against the write schema at every depth -- arity, kind, name, strictly positive ids, and ids unique across the whole tree -- then lowers it to what ParquetWriterOptions expects. The uniqueness check is the one that matters beyond crash safety: Iceberg requires table-global unique ids, so two sibling structs each carrying id 5 would otherwise produce a well-formed footer that resolves to the wrong column.
malinjawi
force-pushed
the
split/parquet-field-id-resolver
branch
from
September 2, 2026 12:25
0640b5b to
9a5bddc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
IcebergWritertrusted the incoming field-id proto and indexed it positionally, so a proto that disagreed with the Velox row type was an out-of-bounds read rather than an error. Velox only checks arity shallowly and stops recursing at non-ROW array elements, soARRAY<ARRAY<T>>andARRAY<MAP<K,V>>reach an unguarded.at(0)inside Velox instead of a diagnostic.This adds a shared resolver that validates a decoded field-id tree against the write schema at every depth — arity, kind, name, strictly positive ids, and ids unique across the whole tree — then lowers it to what
ParquetWriterOptionsexpects. Call sites use.at(i), so a residual mismatch throws.The uniqueness check is the one that matters beyond crash safety: Iceberg requires table-global unique ids, so two sibling structs each carrying id 5 would otherwise produce a well-formed footer that resolves to the wrong column.
How was this patch tested?
New
ParquetFieldIdsTest.cccovers primitives, nested structs, arrays, maps, array-of-struct, nested arrays, name-less resolution, absent ids and the empty tree.Notes
Draft — I haven't been able to run the C++ locally, so I'd like CI to build it first.
The
ParquetFieldIdSchemadecoder is currently only reached from tests; it's the intended entry point for the Delta write path and lands with the follow-up, so say the word if you'd rather it came later instead.