[
https://issues.apache.org/jira/browse/AVRO-4270?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martin Tzvetanov Grigorov resolved AVRO-4270.
---------------------------------------------
Fix Version/s: 1.12.2
Assignee: Martin Tzvetanov Grigorov
Resolution: Fixed
> Fix wrong schema accessor in avro_generic_map_class
> ---------------------------------------------------
>
> Key: AVRO-4270
> URL: https://issues.apache.org/jira/browse/AVRO-4270
> Project: Apache Avro
> Issue Type: Bug
> Components: c
> Affects Versions: 1.12.1
> Reporter: Deho Kim
> Assignee: Martin Tzvetanov Grigorov
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.13.0, 1.12.2
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> h2. Summary
> avro_generic_map_class() in lang/c/src/generic.c incorrectly calls
> avro_schema_array_items(schema) instead of avro_schema_map_values(schema).
> This is a copy-paste bug from the array class implementation.
> h2. Problem
> The wrong accessor reinterprets a MAP schema pointer as an ARRAY schema type.
> Under UndefinedBehaviorSanitizer with -fno-sanitize-recover, this triggers a
> fatal diagnostic when processing MAP schemas.
> Without sanitizers, the code silently returns the correct value today because
> avro_array_schema_t and avro_map_schema_t share the same memory layout
> (items/values at the same offset). This is fragile and will break silently if
> the struct layouts diverge.
> h2. Affected Code
> * File: lang/c/src/generic.c
> * Function: avro_generic_map_class()
> * Buggy line:
> {code}
> avro_schema_t child_schema = avro_schema_array_items(schema);
> {code}
> h2. Suggested Fix
> {code}
> avro_schema_t child_schema = avro_schema_map_values(schema);
> {code}
> h2. Steps to Reproduce
> # Build the C library with ASan + UBSan:
> {code}
> cmake .. -DCMAKE_C_FLAGS="-fsanitize=address,undefined
> -fno-sanitize-recover=undefined -g -O1"
> make avro-static
> {code}
> # Run value_reader_fuzzer with a PoC input that selects schema index 12
> (\{"type":"map","values":"string"})
> # Observe UBSan abort in the map value initialization path
> h2. Expected Behavior
> MAP schemas use avro_schema_map_values() to obtain the child value schema.
> h2. Actual Behavior
> MAP schemas incorrectly use avro_schema_array_items(), causing UBSan failure
> on instrumented builds.
> h2. Impact
> * Severity: Low
> * UBSan-fatal builds: process abort
> * Production (no sanitizers): no crash observed today, but incorrect API usage
> * No memory corruption or information leak observed
> h2. Environment
> * Commit tested: bd70a0859b9d739aad0547aa61bd17291049773b (main, 2026-06-02)
> * Compiler: clang with -fsanitize=address,undefined
> * JSON backend: libjansson
> h2. Discovery
> Discovered by FuzzingBrain @O2Lab via value_reader_fuzzer targeting
> avro_value_read().
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
