Reject out-of-range column id in StripeInformationImpl::getColumnEncoding

[groeneai]

A corrupt or truncated ORC file can declare more columns in the file type tree than there are ColumnEncoding entries in the stripe footer. getColumnEncoding and getDictionarySize indexed stripeFooter_->columns(colId) directly, so such a column id hit an out-of-range protobuf RepeatedPtrField::Get and aborted the process via an absl CHECK (SIGABRT).

Bound-check the id against columns_size() and throw a ParseError instead, matching how the sibling stream accessors (getStreamInformation) already reject malformed footers.

Found via the ClickHouse AST fuzzer: a fuzzed ORC blob fed to format('ORC', ...) reaches getColumnEncoding through ClickHouse's schema inference (isDictionaryEncoded) for a STRING column and crashes the server. Repro (minimal ORC: root STRUCT with one STRING child, stripe footer with only 1 ColumnEncoding) now returns a clean parse error instead of aborting.

[CLAassistant]

All committers have signed the CLA.

[groeneai]

cc @Avogar — small ORC C++ library fix: bounds-check the column id in StripeInformationImpl::getColumnEncoding/getDictionarySize so a corrupt stripe footer throws ParseError instead of aborting the process. Surfaced by the ClickHouse AST fuzzer via ORC schema inference. Would appreciate a review.

[Avogar]

@groeneai why does this PR contains so many commits? I think you made something wrong or used wrong targer branch

[groeneai]

@Avogar sorry, wrong base branch. The PR was opened against main, but ClickHouse pins contrib/orc to the ClickHouse/2.1.2 branch, so it showed all of main's divergent history (59 commits, unrelated files, CLA from 13 authors).

Retargeted the base to ClickHouse/2.1.2. It is now the single intended commit: +17/-0 in c++/src/StripeStream.hh, and the CLA check is green. Ready for review.

[alexey-milovidov]

This is perfect!