dxbjavid commented on code in PR #3807:
URL: https://github.com/apache/avro/pull/3807#discussion_r3460256960
##########
lang/c/src/codec.c:
##########
@@ -142,6 +142,11 @@ static int decode_snappy(avro_codec_t c, void * data,
int64_t len)
uint32_t crc;
size_t outlen;
+ if (len < 4) {
Review Comment:
good point, that 32-bit overflow would slip straight through. added the
SIZE_MAX bound to the same guard and pushed. builds fine here with the snappy
codec on and the test still passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
