GH-50075: [C++][Gandiva] fix buffer overrun in to_hex int32/int64

[metsw24-max]

Rationale for this change

to_hex_int64 and to_hex_int32 in cpp/src/gandiva/precompiled/string_ops.cc allocate the arena buffer with the bare hex-digit count (16 and 8 bytes) but pass that size + 1 as the snprintf bound. For any full-width value (to_hex(-1::bigint) -> FFFFFFFFFFFFFFFF, INT64_MIN, INT32_MIN, ...) snprintf writes all digits plus the trailing NUL, one byte past the end of the allocation. gdv_fn_context_arena_malloc returns exactly the requested bytes, so the NUL corrupts the adjacent arena allocation. Reachable from the to_hex(bigint) / to_hex(int) Gandiva functions over untrusted column data.

What changes are included in this PR?

Allocate one extra byte in both functions so the allocation matches the snprintf bound, the same fix as GH-49752 applied to the identical pattern in hash_utils.cc.

Are these changes tested?

Yes. The existing TestToHexInt64 / TestToHexInt32 cases already exercise the full-width path (INT64_MIN, INT32_MIN, -1) and run clean under ASAN with this change. Output behaviour is unchanged.

Are there any user-facing changes?

No.

This PR contains a "Critical Fix". It fixes a one-byte out-of-bounds heap write reachable from the to_hex Gandiva functions over untrusted input.

• GitHub Issue: [C++][Gandiva] Buffer overrun in to_hex(int32) and to_hex(int64) #50075

[github-actions]

⚠️ GitHub issue #50075 has been automatically assigned in GitHub to PR creator.

[kou]

Could you use our PR template instead of removing it entirely?

[metsw24-max]

Done, restored the template and filled in the sections. Sorry, I'd trimmed it out when opening the PR.

[kou]

+1

[conbench-apache-arrow]

After merging your PR, Conbench analyzed the 4 benchmarking runs that have been run so far on merge-commit d091957.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 3 possible false positives for unstable benchmarks that are known to sometimes produce them.