Ismaël Mejía created AVRO-4287:
----------------------------------
Summary: [javascript] Enforce a maximum decompressed block size
Key: AVRO-4287
URL: https://issues.apache.org/jira/browse/AVRO-4287
Project: Apache Avro
Issue Type: Sub-task
Components: javascript
Affects Versions: 1.13.0
Reporter: Ismaël Mejía
{{BlockDecoder}} in {{lang/js/lib/files.js}} decompresses deflate blocks with
{{zlib.inflateRaw}} and does not pass Node's {{maxOutputLength}} option, so the
decompressed output is unbounded.
Enforce a configurable maximum decompressed size (e.g. via {{maxOutputLength}}
and equivalent handling for custom codecs) and fail decoding with a clear error
when a block would exceed it. Add a test with a high-ratio block.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
