Copilot commented on code in PR #3846:
URL: https://github.com/apache/avro/pull/3846#discussion_r3564292110
##########
lang/php/lib/Datum/AvroIODatumReader.php:
##########
@@ -43,10 +43,37 @@
*/
class AvroIODatumReader
{
+ /**
+ * Default upper bound on the number of items in a single decoded array or
+ * map. The block count of an array or map is read from the (potentially
+ * untrusted or truncated) input and drives allocation of the resulting
+ * collection. Reading a collection that declares more items than this
limit
+ * throws an {@see AvroIOCollectionSizeException} instead of attempting a
+ * potentially huge allocation. Mirrors the Java SDK's collection item
limit.
+ */
+ public const DEFAULT_MAX_COLLECTION_ITEMS = 2147483639; // 2^31 - 8
Review Comment:
The numeric value for `DEFAULT_MAX_COLLECTION_ITEMS` does not match its
comment/PR description: `2^31 - 8` is 2147483640, but the constant is set to
2147483639. This off-by-one changes the effective default limit.
##########
lang/php/lib/Datum/AvroIODatumReader.php:
##########
@@ -290,6 +317,7 @@ public function readArray(
$blockCount = -$blockCount;
$decoder->readLong(); // Read (and ignore) block size
}
+ $this->checkCollectionItems(count($items), $blockCount);
for ($i = 0; $i < $blockCount; $i++) {
Review Comment:
`readLong()` can return numeric strings when GMP is used (32-bit platforms).
In that case the end-of-array marker is the string "0", and the current strict
loop condition (`0 !== $blockCount`) will not terminate, causing the decoder to
read past the end of the input. Use a non-strict comparison or cast
`$blockCount` to int for the loop condition.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
