iemejia commented on code in PR #3848:
URL: https://github.com/apache/avro/pull/3848#discussion_r3564260988
##########
lang/c/src/value-read.c:
##########
@@ -38,6 +38,50 @@ static int
read_value(avro_reader_t reader, avro_value_t *dest);
+/*
+ * The block count of an array or map is read from the (potentially untrusted
or
+ * truncated) input and drives allocation of the resulting collection. To guard
+ * against unbounded memory allocation from a very large or malformed block
+ * count, the number of items in a single decoded array or map is capped. This
+ * mirrors the Java SDK's collection item limit. The default can be overridden
+ * with the AVRO_MAX_COLLECTION_ITEMS environment variable.
+ */
+
+#define AVRO_DEFAULT_MAX_COLLECTION_ITEMS ((int64_t) 2147483639) /* 2^31 - 8
*/
Review Comment:
The value 2147483639 is intentional — it matches the Java SDK's
`MAX_ARRAY_VM_LIMIT = Integer.MAX_VALUE - 8`. Fixed the misleading comment in
aa1d9eb0c7 (it now reads `Integer.MAX_VALUE - 8` instead of `2^31 - 8`).
##########
lang/c/src/value-read.c:
##########
@@ -59,6 +103,8 @@ read_array_value(avro_reader_t reader, avro_value_t *dest)
"Cannot read array block size: ");
}
+ check(rval, avro_check_collection_items(index, block_count));
Review Comment:
Fixed in aa1d9eb0c7. Added an explicit `INT64_MIN` guard before negating in
`read_array_value` (returns `EINVAL`), so hostile input can no longer trigger
signed-overflow UB. Added a test that feeds an `INT64_MIN` block count (zigzag
of 2^64-1).
##########
lang/c/src/value-read.c:
##########
@@ -95,6 +141,8 @@ read_map_value(avro_reader_t reader, avro_value_t *dest)
"Cannot read map block size: ");
}
+ check(rval, avro_check_collection_items(index, block_count));
Review Comment:
Fixed in aa1d9eb0c7 — the same `INT64_MIN` guard was added to
`read_map_value`, covered by the same test (map case included).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
