From d490bd6f8d02a4e5d44efb41a816bbe005b42b41 Mon Sep 17 00:00:00 2001
From: Advit Arora <advitarora2@gmail.com>
Date: Thu, 8 Oct 2026 17:19:34 -0700
Subject: [PATCH 1/4] GH-46557: [C++][R] Check overflow in float to int casts
 that allow truncation

---
 .../compute/kernels/scalar_cast_numeric.cc    | 85 ++++++++++++++-----
 .../arrow/compute/kernels/scalar_cast_test.cc | 36 ++++++++
 r/R/expression.R                              |  2 +-
 3 files changed, 99 insertions(+), 24 deletions(-)

diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
index ba2a8c4b5638..d63befe01d14 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
@@ -17,6 +17,8 @@
 
 // Implementation of casting to integer, floating point, or decimal types
 
+#include <cmath>
+
 #include "arrow/array/builder_primitive.h"
 #include "arrow/compute/kernels/common_internal.h"
 #include "arrow/compute/kernels/scalar_cast_internal.h"
@@ -87,12 +89,47 @@ struct WasTruncated<HalfFloatType, OutType> {
   }
 };
 
-// InType is a floating point type we are planning to cast to integer
 template <typename InType, typename OutType, typename InT = typename InType::c_type,
           typename OutT = typename OutType::c_type>
+struct WasOutOfRange {
+  // Both bounds are zero or a power of two, so they are exact in InT
+  static constexpr auto kMin = static_cast<InT>(std::numeric_limits<OutT>::min());
+  static constexpr auto kMaxPlusOne =
+      static_cast<InT>(std::numeric_limits<OutT>::max() / 2 + 1) * 2;
+
+  static bool Check(OutT, InT in_val) {
+    return !(std::trunc(in_val) >= kMin) | !(in_val < kMaxPlusOne);
+  }
+
+  static bool CheckMaybeNull(OutT out_val, InT in_val, bool is_valid) {
+    return is_valid && Check(out_val, in_val);
+  }
+};
+
+template <typename OutType>
+struct WasOutOfRange<HalfFloatType, OutType> {
+  using OutT = typename OutType::c_type;
+  static bool Check(OutT out_val, uint16_t in_val) {
+    return WasOutOfRange<FloatType, OutType>::Check(out_val,
+                                                    Float16::FromBits(in_val).ToFloat());
+  }
+
+  static bool CheckMaybeNull(OutT out_val, uint16_t in_val, bool is_valid) {
+    return is_valid && Check(out_val, in_val);
+  }
+};
+
+// InType is a floating point type we are planning to cast to integer
+template <template <typename...> class Checker, typename InType, typename OutType,
+          typename InT = typename InType::c_type,
+          typename OutT = typename OutType::c_type>
 ARROW_DISABLE_UBSAN("float-cast-overflow")
-Status CheckFloatTruncation(const ArraySpan& input, const ArraySpan& output) {
+Status CheckFloatToIntValues(const ArraySpan& input, const ArraySpan& output) {
   auto GetErrorMessage = [&](InT val) {
+    if (WasOutOfRange<InType, OutType>::Check(OutT{}, val)) {
+      return Status::Invalid("Float value ", val, " out of range converting to ",
+                             *output.type);
+    }
     return Status::Invalid("Float value ", val, " was truncated converting to ",
                            *output.type);
   };
@@ -110,20 +147,19 @@ Status CheckFloatTruncation(const ArraySpan& input, const ArraySpan& output) {
     if (block.popcount == block.length) {
       // Fast path: branchless
       for (int64_t i = 0; i < block.length; ++i) {
-        block_out_of_bounds |=
-            WasTruncated<InType, OutType>::Check(out_data[i], in_data[i]);
+        block_out_of_bounds |= Checker<InType, OutType>::Check(out_data[i], in_data[i]);
       }
     } else if (block.popcount > 0) {
       // Indices have nulls, must only boundscheck non-null values
       for (int64_t i = 0; i < block.length; ++i) {
-        block_out_of_bounds |= WasTruncated<InType, OutType>::CheckMaybeNull(
+        block_out_of_bounds |= Checker<InType, OutType>::CheckMaybeNull(
             out_data[i], in_data[i], bit_util::GetBit(bitmap, offset_position + i));
       }
     }
     if (ARROW_PREDICT_FALSE(block_out_of_bounds)) {
       if (input.GetNullCount() > 0) {
         for (int64_t i = 0; i < block.length; ++i) {
-          if (WasTruncated<InType, OutType>::CheckMaybeNull(
+          if (Checker<InType, OutType>::CheckMaybeNull(
                   out_data[i], in_data[i],
                   bit_util::GetBit(bitmap, offset_position + i))) {
             return GetErrorMessage(in_data[i]);
@@ -131,7 +167,7 @@ Status CheckFloatTruncation(const ArraySpan& input, const ArraySpan& output) {
         }
       } else {
         for (int64_t i = 0; i < block.length; ++i) {
-          if (WasTruncated<InType, OutType>::Check(out_data[i], in_data[i])) {
+          if (Checker<InType, OutType>::Check(out_data[i], in_data[i])) {
             return GetErrorMessage(in_data[i]);
           }
         }
@@ -145,25 +181,25 @@ Status CheckFloatTruncation(const ArraySpan& input, const ArraySpan& output) {
   return Status::OK();
 }
 
-template <typename InType>
-Status CheckFloatToIntTruncationImpl(const ArraySpan& input, const ArraySpan& output) {
+template <template <typename...> class Checker, typename InType>
+Status CheckFloatToIntImpl(const ArraySpan& input, const ArraySpan& output) {
   switch (output.type->id()) {
     case Type::INT8:
-      return CheckFloatTruncation<InType, Int8Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, Int8Type>(input, output);
     case Type::INT16:
-      return CheckFloatTruncation<InType, Int16Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, Int16Type>(input, output);
     case Type::INT32:
-      return CheckFloatTruncation<InType, Int32Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, Int32Type>(input, output);
     case Type::INT64:
-      return CheckFloatTruncation<InType, Int64Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, Int64Type>(input, output);
     case Type::UINT8:
-      return CheckFloatTruncation<InType, UInt8Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, UInt8Type>(input, output);
     case Type::UINT16:
-      return CheckFloatTruncation<InType, UInt16Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, UInt16Type>(input, output);
     case Type::UINT32:
-      return CheckFloatTruncation<InType, UInt32Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, UInt32Type>(input, output);
     case Type::UINT64:
-      return CheckFloatTruncation<InType, UInt64Type>(input, output);
+      return CheckFloatToIntValues<Checker, InType, UInt64Type>(input, output);
     default:
       break;
   }
@@ -171,15 +207,16 @@ Status CheckFloatToIntTruncationImpl(const ArraySpan& input, const ArraySpan& ou
   return Status::OK();
 }
 
-Status CheckFloatToIntTruncation(const ExecValue& input, const ExecResult& output) {
+template <template <typename...> class Checker>
+Status CheckFloatToInt(const ExecValue& input, const ExecResult& output) {
   switch (input.type()->id()) {
     case Type::FLOAT:
-      return CheckFloatToIntTruncationImpl<FloatType>(input.array, *output.array_span());
+      return CheckFloatToIntImpl<Checker, FloatType>(input.array, *output.array_span());
     case Type::DOUBLE:
-      return CheckFloatToIntTruncationImpl<DoubleType>(input.array, *output.array_span());
+      return CheckFloatToIntImpl<Checker, DoubleType>(input.array, *output.array_span());
     case Type::HALF_FLOAT:
-      return CheckFloatToIntTruncationImpl<HalfFloatType>(input.array,
-                                                          *output.array_span());
+      return CheckFloatToIntImpl<Checker, HalfFloatType>(input.array,
+                                                         *output.array_span());
     default:
       break;
   }
@@ -192,7 +229,9 @@ Status CastFloatingToInteger(KernelContext* ctx, const ExecSpan& batch, ExecResu
   CastNumberToNumberUnsafe(batch[0].type()->id(), out->type()->id(), batch[0].array,
                            out->array_span_mutable());
   if (!options.allow_float_truncate) {
-    RETURN_NOT_OK(CheckFloatToIntTruncation(batch[0], *out));
+    RETURN_NOT_OK(CheckFloatToInt<WasTruncated>(batch[0], *out));
+  } else if (!options.allow_int_overflow) {
+    RETURN_NOT_OK(CheckFloatToInt<WasOutOfRange>(batch[0], *out));
   }
   return Status::OK();
 }
diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_test.cc b/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
index 864ec4afce0c..6b4df856335d 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
@@ -398,6 +398,42 @@ TEST(Cast, FloatingToInt) {
   }
 }
 
+TEST(Cast, FloatingToIntOverflow) {
+  for (auto from : {float16(), float32(), float64()}) {
+    for (bool allow_float_truncate : {false, true}) {
+      auto opts = CastOptions::Safe(int8());
+      opts.allow_float_truncate = allow_float_truncate;
+      for (auto json : {"[128.0]", "[-129.0]", "[NaN]", "[Inf]", "[-Inf]"}) {
+        CheckCastFails(ArrayFromJSON(from, json), opts);
+      }
+      CheckCast(ArrayFromJSON(from, "[127.0, null, -128.0]"),
+                ArrayFromJSON(int8(), "[127, null, -128]"), opts);
+
+      opts.to_type = uint8();
+      CheckCastFails(ArrayFromJSON(from, "[256.0]"), opts);
+      CheckCastFails(ArrayFromJSON(from, "[-1.0]"), opts);
+    }
+
+    auto opts = CastOptions::Safe(int8());
+    opts.allow_float_truncate = true;
+    CheckCast(ArrayFromJSON(from, "[127.5, -128.5]"),
+              ArrayFromJSON(int8(), "[127, -128]"), opts);
+    opts.to_type = uint8();
+    CheckCast(ArrayFromJSON(from, "[255.5, -0.5]"), ArrayFromJSON(uint8(), "[255, 0]"),
+              opts);
+  }
+
+  for (auto from : {float32(), float64()}) {
+    auto opts = CastOptions::Safe(int64());
+    opts.allow_float_truncate = true;
+    CheckCastFails(ArrayFromJSON(from, "[9223372036854775808.0]"), opts);
+    CheckCast(ArrayFromJSON(from, "[-9223372036854775808.0]"),
+              ArrayFromJSON(int64(), "[-9223372036854775808]"), opts);
+    opts.to_type = uint64();
+    CheckCastFails(ArrayFromJSON(from, "[18446744073709551616.0]"), opts);
+  }
+}
+
 TEST(Cast, FloatingToFloating) {
   for (auto from : {float16(), float32(), float64()}) {
     for (auto to : {float16(), float32(), float64()}) {
diff --git a/r/R/expression.R b/r/R/expression.R
index 78272323c709..3eb5de155b63 100644
--- a/r/R/expression.R
+++ b/r/R/expression.R
@@ -211,7 +211,7 @@ Expression$op <- function(FUN, ..., args = list(...)) {
         "if_else",
         Expression$op("==", args[[2]], 0L),
         Scalar$create(NA_integer_, out_type),
-        cast(out, out_type, allow_float_truncate = TRUE)
+        cast(out, out_type, allow_float_truncate = TRUE, allow_int_overflow = TRUE)
       )
     }
     return(out)

From d255ed47497db88c0bc78178528090abf1721cea Mon Sep 17 00:00:00 2001
From: Advit Arora <advitarora2@gmail.com>
Date: Thu, 8 Oct 2026 18:38:01 -0700
Subject: [PATCH 2/4] Keep safe cast error messages unchanged

---
 cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
index d63befe01d14..c7a2a0004755 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
@@ -126,7 +126,8 @@ template <template <typename...> class Checker, typename InType, typename OutTyp
 ARROW_DISABLE_UBSAN("float-cast-overflow")
 Status CheckFloatToIntValues(const ArraySpan& input, const ArraySpan& output) {
   auto GetErrorMessage = [&](InT val) {
-    if (WasOutOfRange<InType, OutType>::Check(OutT{}, val)) {
+    if constexpr (std::is_same_v<Checker<InType, OutType>,
+                                 WasOutOfRange<InType, OutType>>) {
       return Status::Invalid("Float value ", val, " out of range converting to ",
                              *output.type);
     }

From a7a29eebb58b8f413352d474b164b4141bbc5787 Mon Sep 17 00:00:00 2001
From: Advit Arora <advitarora2@gmail.com>
Date: Thu, 8 Oct 2026 19:33:11 -0700
Subject: [PATCH 3/4] Disable float-cast-overflow sanitizer in half float to
 int cast

---
 cpp/src/arrow/compute/kernels/scalar_cast_internal.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_internal.cc b/cpp/src/arrow/compute/kernels/scalar_cast_internal.cc
index 0484e0b259c5..695ea8e1fe9c 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_internal.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_internal.cc
@@ -113,6 +113,7 @@ struct CastPrimitive<HalfFloatType, InType, enable_if_integer<InType>> {
 // Cast half float to int
 template <typename OutType>
 struct CastPrimitive<OutType, HalfFloatType, enable_if_integer<OutType>> {
+  ARROW_DISABLE_UBSAN("float-cast-overflow")
   static void Exec(const ArraySpan& arr, ArraySpan* out) {
     using OutT = typename OutType::c_type;
     const uint16_t* in_values = arr.GetValues<uint16_t>(1);

From 95a26881765434edf6c1b9b5a2672e7545e9a559 Mon Sep 17 00:00:00 2001
From: Advit Arora <advitarora2@gmail.com>
Date: Sun, 11 Oct 2026 10:29:41 -0700
Subject: [PATCH 4/4] Decode half float values in cast error messages

---
 cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc | 9 ++++++++-
 cpp/src/arrow/compute/kernels/scalar_cast_test.cc    | 7 +++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
index c7a2a0004755..9720ca1a6008 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_numeric.cc
@@ -125,7 +125,14 @@ template <template <typename...> class Checker, typename InType, typename OutTyp
           typename OutT = typename OutType::c_type>
 ARROW_DISABLE_UBSAN("float-cast-overflow")
 Status CheckFloatToIntValues(const ArraySpan& input, const ArraySpan& output) {
-  auto GetErrorMessage = [&](InT val) {
+  auto GetErrorMessage = [&](InT in_val) {
+    const auto val = [in_val] {
+      if constexpr (std::is_same_v<InType, HalfFloatType>) {
+        return Float16::FromBits(in_val).ToFloat();
+      } else {
+        return in_val;
+      }
+    }();
     if constexpr (std::is_same_v<Checker<InType, OutType>,
                                  WasOutOfRange<InType, OutType>>) {
       return Status::Invalid("Float value ", val, " out of range converting to ",
diff --git a/cpp/src/arrow/compute/kernels/scalar_cast_test.cc b/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
index 6b4df856335d..331a9ea88af7 100644
--- a/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
+++ b/cpp/src/arrow/compute/kernels/scalar_cast_test.cc
@@ -432,6 +432,13 @@ TEST(Cast, FloatingToIntOverflow) {
     opts.to_type = uint64();
     CheckCastFails(ArrayFromJSON(from, "[18446744073709551616.0]"), opts);
   }
+
+  auto opts = CastOptions::Safe(int8());
+  EXPECT_RAISES_WITH_MESSAGE_THAT(Invalid, ::testing::HasSubstr("Float value 1.5"),
+                                  Cast(ArrayFromJSON(float16(), "[1.5]"), opts));
+  opts.allow_float_truncate = true;
+  EXPECT_RAISES_WITH_MESSAGE_THAT(Invalid, ::testing::HasSubstr("Float value inf out"),
+                                  Cast(ArrayFromJSON(float16(), "[Inf]"), opts));
 }
 
 TEST(Cast, FloatingToFloating) {