fix(reader): reject a vortex.bool bitmap shorter than its row count

The gap #339 exposed one encoding over. MaterializedBoolArray#getBoolean
indexes its buffer with no bounds check, and BoolEncodingDecoder handed
it a file buffer straight through, so a truncated bitmap faulted with a
raw IndexOutOfBoundsException on whichever row ran off the end — and
`materialize` handed the short buffer to the caller intact.

Checked once at decode, in O(1). The unchecked accessor stays unchecked
on purpose: the other four construction sites all allocate the bitmap
themselves at exactly (n + 7) / 8, so a per-row bound there would be
dead at every site but this one, and this one can answer it once.

The guard found a real under-sized fixture on its first run.
RleEncodingEncoderTest's hand-built nullable-indices node supplied a
1-byte validity bitmap for an indices child that declares `indices_len`
rows — which the encoder pads to a 1024 chunk boundary. Reading any row
past 7 would have faulted; the test only ever read rows 0 through 3. The
fixture now sizes the bitmap for what the node declares. Nothing else in
the reactor, writer output or Rust fixture alike, supplied a short one.

Companion to the #339 bytebool fix in this PR; same class of bug, and
the bytebool PR is where it was spotted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: dfa1

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - A `vortex.bytebool` column is now read in place from its mmapped buffer, as `docs/compatibility.md` already claimed: decode allocated an `n/8`-byte bitmap and ran a read-modify-write over every row to fill it, for the one boolean encoding whose buffer is already indexable per row. Callers that want a bitmap still get one from `materialize`. ([#339](https://github.com/dfa1/vortex-java/issues/339))
 - A `vortex.bytebool` buffer shorter than the declared row count now fails as `VortexException` instead of a raw `IndexOutOfBoundsException` on whichever row ran off the end. ([#339](https://github.com/dfa1/vortex-java/issues/339))
+- Same for a `vortex.bool` bitmap holding fewer than the `(rows + 7) / 8` bytes it needs, reached either as a column or as another column's validity child. ([#339](https://github.com/dfa1/vortex-java/issues/339))
 
 - A malformed `fastlanes.delta` column no longer fails with a raw JDK exception: a row window running past the elements the chunks reconstruct threw `ArrayIndexOutOfBoundsException`, and an absurd or negative declared element count sized a heap array before anything checked it (`NegativeArraySizeException`, or `OutOfMemoryError`). All now fail as `VortexException`. ([#338](https://github.com/dfa1/vortex-java/issues/338))
 - A `fastlanes.delta` column no longer routes its decode through four row-scaled heap `long[]` arrays, every value widened to 8 bytes whatever the column's width; values are reconstructed into a single arena segment at the ptype's real width, and only the chunks overlapping the requested rows are reconstructed at all. ([#338](https://github.com/dfa1/vortex-java/issues/338))

reader/src/main/java/io/github/dfa1/vortex/reader/array/MaterializedBoolArray.java

@@ -8,6 +8,12 @@
 
 /// Buffer-backed [BoolArray] — the fallback used when an encoding decoder
 /// either materializes the output eagerly or has no lazy variant of its own.
+///
+/// [#getBoolean(long)] indexes `buffer` without a bounds check, so the buffer must hold at
+/// least `(length + 7) / 8` bytes. Every decoder that builds the bitmap itself allocates
+/// exactly that; the one that passes a file buffer through
+/// (`io.github.dfa1.vortex.reader.decode.BoolEncodingDecoder`) checks the size once before
+/// constructing this, rather than paying a bound per row.
 public final class MaterializedBoolArray extends AbstractMaterializedArray implements BoolArray {
 
     /// Constructs a `MaterializedBoolArray` backed by the given bit-packed buffer.

reader/src/main/java/io/github/dfa1/vortex/reader/decode/BoolEncodingDecoder.java

@@ -8,6 +8,8 @@
 import io.github.dfa1.vortex.reader.array.MaskedArray;
 import io.github.dfa1.vortex.reader.array.MaterializedBoolArray;
 
+import java.lang.foreign.MemorySegment;
+
 /// Read-only decoder for `vortex.bool` (bit-packed boolean arrays, LSB first).
 ///
 /// When the encoding node has one child, that child is the validity bitmask:
@@ -23,7 +25,20 @@ public EncodingId encodingId() {
     @Override
     public Array decode(DecodeContext ctx) {
         long n = ctx.rowCount();
-        Array values = new MaterializedBoolArray(ctx.dtype(), n, ctx.buffer(0));
+        MemorySegment bits = ctx.buffer(0);
+        // The bitmap comes straight from the file and needs one byte per 8 rows. A shorter one
+        // is malformed, and [MaterializedBoolArray#getBoolean] indexes its buffer unchecked —
+        // deliberately, since every other construction site allocates the bitmap itself at
+        // exactly this size — so without this the read of whichever row runs off the end is a
+        // raw IndexOutOfBoundsException (ADR 0003). O(1), and it also covers `materialize`,
+        // which hands the same short buffer straight to the caller.
+        long needed = (n + 7) >>> 3;
+        if (bits.byteSize() < needed) {
+            throw new VortexException(EncodingId.VORTEX_BOOL,
+                    "bool bitmap of " + bits.byteSize() + " byte(s) is shorter than the "
+                            + needed + " byte(s) needed for " + n + " row(s)");
+        }
+        Array values = new MaterializedBoolArray(ctx.dtype(), n, bits);
         if (ctx.node().children().length == 1) {
             Array va = ctx.decodeChild(0, DType.BOOL, n);
             if (!(va instanceof BoolArray validity)) {

reader/src/test/java/io/github/dfa1/vortex/reader/decode/BoolEncodingDecoderTest.java

@@ -1,5 +1,6 @@
 package io.github.dfa1.vortex.reader.decode;
 
+import io.github.dfa1.vortex.core.error.VortexException;
 import io.github.dfa1.vortex.core.model.EncodingId;
 import io.github.dfa1.vortex.core.testing.DTypes;
 import io.github.dfa1.vortex.reader.ReadRegistry;
@@ -9,13 +10,15 @@
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.CsvSource;
 import org.junit.jupiter.params.provider.MethodSource;
 
 import java.lang.foreign.Arena;
 import java.lang.foreign.MemorySegment;
 import java.util.stream.Stream;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 class BoolEncodingDecoderTest {
 
@@ -105,6 +108,73 @@ void decode_nullable_returnsMaskedArray_withNullsHidingUnderlying() {
         assertThat(inner.getBoolean(2)).isFalse();
     }
 
+    /// The bitmap is untrusted and needs one byte per 8 rows. `MaterializedBoolArray` indexes
+    /// its buffer without a per-row bound — deliberately, since every other decoder that builds
+    /// a bitmap allocates it at exactly the right size — so a short one used to fault as a raw
+    /// `IndexOutOfBoundsException` on whichever row ran off the end, or hand the truncated
+    /// buffer straight out of `materialize`. It must be a [VortexException] (ADR 0003).
+    ///
+    /// The row counts are one past each byte boundary, where a bitmap is at its most
+    /// deceptive: 9 rows need 2 bytes, not the 1 that covers the first 8.
+    @ParameterizedTest
+    @CsvSource({"9, 1", "17, 2", "65, 8", "8, 0"})
+    void decode_bitmapShorterThanRowCount_throws(int rows, int suppliedBytes) {
+        // Given
+        MemorySegment bits = MemorySegment.ofArray(new byte[suppliedBytes]);
+        ArrayNode node = new ArrayNode(EncodingId.VORTEX_BOOL, null, new ArrayNode[0], new int[]{0});
+        ReadRegistry registry = TestRegistry.ofDecoders(new BoolEncodingDecoder());
+        DecodeContext ctx = new DecodeContext(node, DTypes.BOOL, rows, new MemorySegment[]{bits},
+                registry, Arena.ofAuto());
+        var sut = new BoolEncodingDecoder();
+
+        // When / Then
+        assertThatThrownBy(() -> sut.decode(ctx))
+                .isInstanceOf(VortexException.class)
+                .hasMessageContaining("bool bitmap");
+    }
+
+    /// The same guard reached through the validity child, which decodes as its own
+    /// `vortex.bool` array: a values bitmap long enough for the row count paired with a
+    /// truncated validity bitmap must fail just as loudly.
+    @Test
+    void decode_nullable_validityBitmapTooShort_throws() {
+        // Given — 9 rows of values (2 bytes) but a 1-byte validity bitmap
+        MemorySegment bits = MemorySegment.ofArray(new byte[2]);
+        MemorySegment validBits = MemorySegment.ofArray(new byte[1]);
+        ArrayNode validityNode = new ArrayNode(EncodingId.VORTEX_BOOL, null, new ArrayNode[0], new int[]{1});
+        ArrayNode node = new ArrayNode(EncodingId.VORTEX_BOOL, null, new ArrayNode[]{validityNode}, new int[]{0});
+        ReadRegistry registry = TestRegistry.ofDecoders(new BoolEncodingDecoder());
+        DecodeContext ctx = new DecodeContext(node, DTypes.BOOL_N, 9,
+                new MemorySegment[]{bits, validBits}, registry, Arena.ofAuto());
+        var sut = new BoolEncodingDecoder();
+
+        // When / Then
+        assertThatThrownBy(() -> sut.decode(ctx))
+                .isInstanceOf(VortexException.class)
+                .hasMessageContaining("bool bitmap");
+    }
+
+    /// A bitmap longer than the row count needs is legal — trailing padding, or a buffer shared
+    /// with a longer array — and must not be rejected by the size guard.
+    @Test
+    void decode_bitmapLongerThanNeeded_isAccepted() {
+        // Given — 3 rows (1 byte needed) over an 8-byte buffer with bit 0 set
+        MemorySegment bits = MemorySegment.ofArray(new byte[]{1, 0, 0, 0, 0, 0, 0, 0});
+        ArrayNode node = new ArrayNode(EncodingId.VORTEX_BOOL, null, new ArrayNode[0], new int[]{0});
+        ReadRegistry registry = TestRegistry.ofDecoders(new BoolEncodingDecoder());
+        DecodeContext ctx = new DecodeContext(node, DTypes.BOOL, 3, new MemorySegment[]{bits},
+                registry, Arena.ofAuto());
+        var sut = new BoolEncodingDecoder();
+
+        // When
+        var result = sut.decode(ctx);
+
+        // Then
+        assertThat(result.length()).isEqualTo(3);
+        assertThat(((BoolArray) result).getBoolean(0)).isTrue();
+        assertThat(((BoolArray) result).getBoolean(1)).isFalse();
+    }
+
     @Test
     void decode_nullable_allNulls_allRowsInvalid() {
         // Given — every validity bit is false; values buffer content does not matter

writer/src/test/java/io/github/dfa1/vortex/writer/encode/RleEncodingEncoderTest.java

@@ -315,8 +315,12 @@ void decode_nullableIndices_returnsMaskedArrayWithCorrectValidity() {
             EncodeResult encoded = ENCODER.encode(dtype, data, EncodeTestHelper.testCtx());
 
             List<MemorySegment> originalBufs = new ArrayList<>(encoded.buffers());
-            MemorySegment validityBuf = MemorySegment.ofArray(new byte[]{0x05});
-            originalBufs.add(validityBuf);
+            // The indices child declares `indices_len` rows, which the encoder pads to a 1024
+            // chunk boundary, so its validity bitmap has to cover all 1024 — not just the four
+            // rows this fixture cares about. Bits 0 and 2 set: rows 0 and 2 valid, 1 and 3 null.
+            byte[] validityBits = new byte[(1024 + 7) / 8];
+            validityBits[0] = 0x05;
+            originalBufs.add(MemorySegment.ofArray(validityBits));
             MemorySegment[] segments = originalBufs.toArray(new MemorySegment[0]);
 
             ArrayNode origRoot = toArrayNode(encoded.rootNode());