Merge branch 'main' into fix-nullable-binary-arrays

Author: kishansinghifs1

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Bug Fixes 
 
 - **[client-v2]** Fixed binary array decoding for nullable element types so `Array(Nullable(Float64))` and similar columns now return boxed arrays such as `Double[]` instead of `Object[]`. This keeps null-supporting arrays aligned with their element type while preserving the existing `Object[]` fallback for Variant/Dynamic/Geometry arrays. (https://github.com/ClickHouse/clickhouse-java/issues/2846)
+- **[client-v2]** Fixed binary varint decoding for length and count fields so overflowing or overlong values fail with an `IOException` instead of being decoded into corrupted or negative `int` values. (https://github.com/ClickHouse/clickhouse-java/issues/2902)
 
 - **[client-v2]** Fixed container query parameters being sent unquoted, so `Client.query(sql, params, settings)` binding
   a `List<LocalDate>` (or an array/`Map`) to a placeholder like `{ids:Array(Date)}` was rejected by the server with

client-v2/src/main/java/com/clickhouse/client/api/data_formats/internal/BinaryStreamReader.java

@@ -1022,16 +1022,20 @@ private double[][][][] readGeoMultiPolygon() throws IOException {
     public static int readVarInt(InputStream input) throws IOException {
         int value = 0;
 
-        for (int i = 0; i < 10; i++) {
+        for (int i = 0; i < 5; i++) {
             byte b = (byte) readByteOrEOF(input);
+            if (i == 4 && (b & 0xF8) != 0) {
+                throw new IOException("VarInt is too large for int");
+            }
+
             value |= (b & 0x7F) << (7 * i);
 
             if ((b & 0x80) == 0) {
-                break;
+                return value;
             }
         }
 
-        return value;
+        throw new IOException("Malformed VarInt");
     }
 
     /**