GH-51005: [C++] Fix over-read in UriFromAbsolutePath posix branch

cpp/src/arrow/util/uri.cc

@@ -338,8 +338,13 @@ Result<std::string> UriFromAbsolutePath(std::string_view path) {
   // uriWindowsFilenameToUriStringA basically only fails if a null pointer is given.
   ARROW_CHECK_EQ(r, 0) << "uriWindowsFilenameToUriStringA unexpectedly failed";
 #else
-  out.resize(7 + 3 * path.length() + 1);
-  int r = uriUnixFilenameToUriStringA(path.data(), out.data());
+  // uriUnixFilenameToUriStringA scans its argument as a NUL-terminated C string,
+  // but a std::string_view is not required to be NUL-terminated. Copy into a
+  // std::string first (as the Windows branch above already does) so the routine
+  // cannot read past the end of the view.
+  std::string fixed_path(path);
+  out.resize(7 + 3 * fixed_path.length() + 1);
+  int r = uriUnixFilenameToUriStringA(fixed_path.data(), out.data());
   // same as above (uriWindowsFilenameToUriStringA)
   ARROW_CHECK_EQ(r, 0) << "uriUnixFilenameToUriStringA unexpectedly failed";
 #endif

cpp/src/arrow/util/uri_test.cc

@@ -17,6 +17,7 @@
 
 #include <memory>
 #include <string>
+#include <string_view>
 #include <utility>
 #include <vector>
 
@@ -370,4 +371,19 @@ TEST(UriFromAbsolutePath, Basics) {
 #endif
 }
 
+TEST(UriFromAbsolutePath, NonNulTerminatedView) {
+  // The argument is a std::string_view, which is not required to be
+  // NUL-terminated. A view backed by a larger buffer must not make the
+  // conversion consume bytes beyond the view's length.
+#ifdef _WIN32
+  std::string backing = "C:/foo/bar and more bytes";
+  std::string_view path(backing.data(), std::string_view("C:/foo/bar").size());
+  ASSERT_OK_AND_EQ("file:///C:/foo/bar", UriFromAbsolutePath(path));
+#else
+  std::string backing = "/tmp/foo and more bytes";
+  std::string_view path(backing.data(), std::string_view("/tmp/foo").size());
+  ASSERT_OK_AND_EQ("file:///tmp/foo", UriFromAbsolutePath(path));
+#endif
+}
+
 }  // namespace arrow::util