AVRO-4324: [Java] Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards

[iemejia]

What changes were proposed in this pull request?

GenericDatumReader.readArray already validates a declared array block count against the bytes actually remaining (ensureAvailableCollectionBytes) and applies a heap-aware bound for element types whose minimum encoded size is zero, before eagerly allocating the backing storage.

The ReflectDatumReader.readArray override did not apply these guards: it called newArray(old, (int) l, ...) → Array.newInstance(elementClass, count) using the declared block count directly, so a malformed or truncated record mapped to a Java array field (for example long[]) could drive a large eager allocation before a single element was read.

This aligns ReflectDatumReader.readArray with the generic reader by applying the same ensureAvailableCollectionBytes and checkMaxCollectionAllocation guards before the allocation. Malformed input now fails fast (EOFException) instead of over-allocating; valid arrays read unchanged.

How was this patch tested?

• New test in TestReflectDatumReader:
  • read_PojoWithArray_rejectsOversizedArrayCount — a record declaring a ~2e9 array block count with no elements now fails fast instead of attempting a large allocation. Existing round-trip tests act as negative controls.
• Full avro module test suite passes.

JIRA

• AVRO-4324

[Copilot]

Pull request overview

Aligns the Java ReflectDatumReader.readArray behavior with GenericDatumReader to avoid large eager allocations on malformed/truncated inputs when decoding Avro arrays into Java array fields.

Changes:

• Add ensureAvailableCollectionBytes and SystemLimitException.checkMaxCollectionAllocation (for zero-byte element schemas) before eager Java array allocation in ReflectDatumReader.readArray.
• Add a regression test ensuring oversized declared array counts fail fast with EOFException.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lang/java/avro/src/main/java/org/apache/avro/reflect/ReflectDatumReader.java	Adds pre-allocation guards to prevent large eager allocations from malformed/truncated array payloads.
lang/java/avro/src/test/java/org/apache/avro/reflect/TestReflectDatumReader.java	Adds a test that asserts oversized declared array counts are rejected early.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iemejia]

Good catch — fixed. I extracted a shared nextArrayBlock helper that re-applies ensureAvailableCollectionBytes and, for zero-byte element schemas, checkMaxCollectionAllocation(existing, l) after every in.arrayNext(), and wired it into both readObjectArray and readCollection while tracking the cumulative count. This mirrors GenericDatumReader.readArray so a large logical array split across blocks is now bounded cumulatively. Added a regression test (read_PojoWithZeroByteList_rejectsCumulativeCountAcrossBlocks) covering two blocks that individually pass but exceed the limit together. (fad19cd)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

lang/java/avro/src/main/java/org/apache/avro/reflect/ReflectDatumReader.java:209

• readObjectArray grows primitive arrays via ArrayAccessor (using Arrays.copyOf), but object arrays never grow. If a valid Avro array is encoded in multiple blocks, the second block can make limit exceed array.length, leading to ArrayIndexOutOfBoundsException while decoding. Mirror the primitive-array path by expanding the array when limit grows before writing elements (in both conversion and non-conversion branches).

      do {
        int limit = index + (int) l;
        while (index < limit) {
          Object element = readWithConversion(null, expectedType, logicalType, conversion, in);
          array[index] = element;