[laurentgo]

What's Changed

ArrowMessage.frame() ignored unknown fields by reading their tag but not their payload, so the payload was parsed as the next tag. The default case now skips the value according to its wire type, as protobuf requires:

• varint: up to 10 bytes (64-bit values);
• fixed64 / fixed32: 8 / 4 bytes;
• length-delimited: the length is read with the existing readFieldLength (which keeps the KnownLength bounds check), then skipped without allocating; short InputStream.skip results are handled and EOF is an error;
• groups: skipped recursively up to a nesting limit (default 100, like protobuf-java's recursion limit; override with -Darrow.flight.max_protobuf_skip_group_depth or ARROW_FLIGHT_MAX_PROTOBUF_SKIP_GROUP_DEPTH), with the end-group field number checked against the start-group;
• invalid wire types and malformed groups: IOException("Malformed FlightData frame: ...").

A known field number sent with a different wire type than expected is treated as an unknown field and skipped too, as protobuf does. The zero-copy read path for known fields is unchanged. This follows apache/arrow#26885 (ARROW-10962), which aligned the parser with protobuf semantics for missing fields.

Tests are in TestArrowMessage: unknown varint (10, 18, 26, 10-byte), length-delimited (0, 10, 18, 26 with tag-like bytes), fixed64, fixed32, groups and nested groups, and known field numbers with wrong wire types, each placed before, between and after the known fields on both known-length and compressed streams. Also covered: the group depth limit, malformed or unterminated groups, invalid wire types and truncated fields. The new tests fail without the fix.

Closes #1337.

The code and the tests were drafted with Claude Code; the author has reviewed both.

[jbonofre]

I believe a tag of 0x00 (field number 0) ends up here. Its wire type is VARINT, so skipField consumes the next byte as its value.

protobuf rejects field number 0, so we could do the same at the top of skipField:

private static void skipField(InputStream stream, int tag, int depth) throws IOException {
  if (WireFormat.getTagFieldNumber(tag) == 0) {
    throw new IOException("Malformed FlightData frame: invalid tag " + tag);
  }
  switch (WireFormat.getTagWireType(tag)) {

The tag == 0 check in skipGroup can then be removed.

[jbonofre]

Maybe we should set an upper bound here, and skip group which is recursive (skipField -> skipGroup -> skipField). With a large setting (like -Darrow.flight.max_protobuf_skip_group_depth=10000000), a peer can send a deeply nested message and overflow the stack.

frame() only catches Exception, so the StackOverFlowError skips the cleanup: appMetadata and body are never released and the allocator leaks.