iemejia opened a new pull request, #3948: URL: https://github.com/apache/avro/pull/3948
## What `avro_schema_enum_get()` (`lang/c/src/schema.c`) called `st_lookup()` but **ignored its return value**: ```c st_lookup(avro_schema_to_enum(enump)->symbols, index, &val.data); return val.sym; /* uninitialized when st_lookup() fails */ ``` For an index outside the schema's symbol range, `st_lookup()` leaves `val.data` untouched, so the function returned an uninitialized stack value as a `char *`. The binary reader (`lang/c/src/value-read.c`, `AVRO_ENUM` case) also passed the enum ordinal read from the input straight through without a range check, so a malformed or truncated container file could drive that path. A caller that then uses the returned symbol name (e.g. `avropipe` calling `strlen()`) reads through an indeterminate pointer and typically crashes with `SIGSEGV` on a default `Release` build. ## Fix - **value-read.c** — validate the decoded ordinal against `avro_schema_enum_number_of_symbols()` and return `EINVAL` for an out-of-range value. - **schema.c** — `avro_schema_enum_get()` returns `NULL` when `st_lookup()` fails, so it can never return an uninitialized pointer even if called directly. ## Tests Adds `test_avro_4344` (self-contained, no data file): a valid ordinal reads successfully; an out-of-range positive ordinal, a negative ordinal, and `avro_schema_enum_get(schema, 99)` are all handled cleanly (error / `NULL`). Verified the test **fails without** the fix and **passes with** it; the full `lang/c` suite (28 tests) passes. JIRA: https://issues.apache.org/jira/browse/AVRO-4344 Reported by Mahdi Alhakim. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
