[
https://issues.apache.org/jira/browse/AVRO-4270?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Deho Kim updated AVRO-4270:
---------------------------
Description:
h2. Summary
avro_generic_map_class() in lang/c/src/generic.c incorrectly calls
avro_schema_array_items(schema) instead of avro_schema_map_values(schema).
This is a copy-paste bug from the array class implementation.
h2. Problem
The wrong accessor reinterprets a MAP schema pointer as an ARRAY schema type.
Under UndefinedBehaviorSanitizer with -fno-sanitize-recover, this triggers a
fatal diagnostic when processing MAP schemas.
Without sanitizers, the code silently returns the correct value today because
avro_array_schema_t and avro_map_schema_t share the same memory layout
(items/values at the same offset). This is fragile and will break silently if
the struct layouts diverge.
h2. Affected Code
* File: lang/c/src/generic.c
* Function: avro_generic_map_class()
* Buggy line:
{code}
avro_schema_t child_schema = avro_schema_array_items(schema);
{code}
h2. Suggested Fix
{code}
avro_schema_t child_schema = avro_schema_map_values(schema);
{code}
h2. Steps to Reproduce
# Build the C library with ASan + UBSan:
{code}
cmake .. -DCMAKE_C_FLAGS="-fsanitize=address,undefined
-fno-sanitize-recover=undefined -g -O1"
make avro-static
{code}
# Run value_reader_fuzzer with a PoC input that selects schema index 12
(\{"type":"map","values":"string"})
# Observe UBSan abort in the map value initialization path
h2. Expected Behavior
MAP schemas use avro_schema_map_values() to obtain the child value schema.
h2. Actual Behavior
MAP schemas incorrectly use avro_schema_array_items(), causing UBSan failure
on instrumented builds.
h2. Impact
* Severity: Low
* UBSan-fatal builds: process abort
* Production (no sanitizers): no crash observed today, but incorrect API usage
* No memory corruption or information leak observed
h2. Environment
* Commit tested: bd70a0859b9d739aad0547aa61bd17291049773b (main, 2026-06-02)
* Compiler: clang with -fsanitize=address,undefined
* JSON backend: libjansson
h2. Discovery
Discovered by FuzzingBrain @O2Lab via value_reader_fuzzer targeting
avro_value_read().
was:
## What is the purpose of the change
`avro_generic_map_class()` in `lang/c/src/generic.c` incorrectly calls
`avro_schema_array_items(schema)` instead of `avro_schema_map_values(schema)`.
This is a copy-paste bug from the array class implementation.
The wrong accessor reinterprets a MAP schema pointer as an ARRAY schema type.
Under UndefinedBehaviorSanitizer with `-fno-sanitize-recover`, this triggers a
fatal diagnostic. Without sanitizers the code silently returns the correct value
today because `avro_array_schema_t` and `avro_map_schema_t` share the same
memory layout, but this is fragile and will break if the struct layouts diverge.
Fixes AVRO-XXXX.
## Verifying this change
This change can be verified as follows:
- Built the C library with ASan + UBSan:
`-fsanitize=address,undefined -fno-sanitize-recover=undefined -g -O1`
- Ran a custom `value_reader_fuzzer` targeting `avro_value_read()` with a
PoC input that selects a `\{"type":"map","values":"string"}` schema
- Before fix: UBSan aborts in the map value initialization path
- After fix: no UBSan diagnostic; input is processed normally
Discovered by FuzzingBrain @O2Lab.
## Documentation
- Does this pull request introduce a new feature? (yes / no)
**no**
- If yes, how is the feature documented? (not applicable / docs / JavaDocs /
not documented)
**not applicable**
> Fix wrong schema accessor in avro_generic_map_class
> ---------------------------------------------------
>
> Key: AVRO-4270
> URL: https://issues.apache.org/jira/browse/AVRO-4270
> Project: Apache Avro
> Issue Type: Bug
> Components: c
> Affects Versions: 1.12.1
> Reporter: Deho Kim
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.13.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Summary
> avro_generic_map_class() in lang/c/src/generic.c incorrectly calls
> avro_schema_array_items(schema) instead of avro_schema_map_values(schema).
> This is a copy-paste bug from the array class implementation.
> h2. Problem
> The wrong accessor reinterprets a MAP schema pointer as an ARRAY schema type.
> Under UndefinedBehaviorSanitizer with -fno-sanitize-recover, this triggers a
> fatal diagnostic when processing MAP schemas.
> Without sanitizers, the code silently returns the correct value today because
> avro_array_schema_t and avro_map_schema_t share the same memory layout
> (items/values at the same offset). This is fragile and will break silently if
> the struct layouts diverge.
> h2. Affected Code
> * File: lang/c/src/generic.c
> * Function: avro_generic_map_class()
> * Buggy line:
> {code}
> avro_schema_t child_schema = avro_schema_array_items(schema);
> {code}
> h2. Suggested Fix
> {code}
> avro_schema_t child_schema = avro_schema_map_values(schema);
> {code}
> h2. Steps to Reproduce
> # Build the C library with ASan + UBSan:
> {code}
> cmake .. -DCMAKE_C_FLAGS="-fsanitize=address,undefined
> -fno-sanitize-recover=undefined -g -O1"
> make avro-static
> {code}
> # Run value_reader_fuzzer with a PoC input that selects schema index 12
> (\{"type":"map","values":"string"})
> # Observe UBSan abort in the map value initialization path
> h2. Expected Behavior
> MAP schemas use avro_schema_map_values() to obtain the child value schema.
> h2. Actual Behavior
> MAP schemas incorrectly use avro_schema_array_items(), causing UBSan failure
> on instrumented builds.
> h2. Impact
> * Severity: Low
> * UBSan-fatal builds: process abort
> * Production (no sanitizers): no crash observed today, but incorrect API usage
> * No memory corruption or information leak observed
> h2. Environment
> * Commit tested: bd70a0859b9d739aad0547aa61bd17291049773b (main, 2026-06-02)
> * Compiler: clang with -fsanitize=address,undefined
> * JSON backend: libjansson
> h2. Discovery
> Discovered by FuzzingBrain @O2Lab via value_reader_fuzzer targeting
> avro_value_read().
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
