[GitHub] [orc] HeenaBansal2009 opened a new issue #1021: ORC Format Parsing – Out-of-Bounds Access in Protobuf Messages

[GitBox]

HeenaBansal2009 opened a new issue #1021:
URL: https://github.com/apache/orc/issues/1021


   what happens if type.fieldnames_size()  is less than the 
type.subtypes_size(). The type.fieldnames(i) will be invalid access. 
   
   File name :  TypeImpl.cc
   ```
   case proto::Type_Kind_STRUCT: {
   TypeImpl* result = new TypeImplSTRUCT);
   uint64_t size = static_cast<uint64_t>(type.subtypes_size());
   std::vector<Type*> typeList(size);
   std::vector<std::string> fieldList(size);
   for(int i=0; i < type.subtypes_size(); ++i)
   { result->addStructField(type.fieldnames(i), 
convertType(footer.types(static_cast<int> (type.subtypes(i))),footer)); }
   return std::unique_ptr<Type>(result);
   ```
   I reproduced the scenario by modifying c++/test/TestType.cc (refer 
screenshot) and it crashed.(refer output screenshot
   <img width="1491" alt="Screen Shot 2022-01-19 at 12 33 21 PM" 
src="https://user-images.githubusercontent.com/86018844/150183885-6ad98a50-bbb0-43ee-b0fe-8e4692f92ae7.png";>
   )
   
   <img width="1386" alt="Screen Shot 2022-01-19 at 12 32 29 PM" 
src="https://user-images.githubusercontent.com/86018844/150183721-4fb5f191-39a4-4f89-b5cc-57e08a6bae7b.png";>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@orc.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org