[ https://issues.apache.org/jira/browse/AVRO-1237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13851723#comment-13851723 ]
ASF subversion and git services commented on AVRO-1237: ------------------------------------------------------- Commit 1551941 from dcrea...@apache.org in branch 'avro/trunk' [ https://svn.apache.org/r1551941 ] AVRO-1237. C: Verify union discriminant when reading Avro data files. Test case submitted by Michael Cooper. Michael's original fix was to perform a bounds check in avro_value_set_branch, but I've opted for a solution in avro_value_read. This has two benefits: the check is only performed when reading a discriminant value from an unsafe source, and it doesn't impose an extra burden on anyone writing their own custom value implementations. > Avro-C segfaults when union discriminant out of bounds > ------------------------------------------------------ > > Key: AVRO-1237 > URL: https://issues.apache.org/jira/browse/AVRO-1237 > Project: Avro > Issue Type: Bug > Components: c > Environment: Avro-C 1.7.2 > Ubuntu 12.04 x86_64 > Reporter: Michael Cooper > Attachments: > 0001-AVRO-1237.-C-Verify-union-discriminant-when-reading-.patch, > 0001-Check-union-discriminant-bounds-in-both-directions.patch, > 0001-Test-case-for-AVRO-1237.patch, avro-1237-bad-union-discriminant.avro, > avro-1237-good.avro > > > libavro will segfault when decrypting a specially crafted (or corrupted) avro > file when the discriminant is out of bounds. > There is already a check for < 0, but there is no upper bounds check. > I have attached a patch that checks the bounds. -- This message was sent by Atlassian JIRA (v6.1.4#6159)