iemejia commented on code in PR #3846:
URL: https://github.com/apache/avro/pull/3846#discussion_r3564377546
##########
lang/php/lib/Datum/AvroIODatumReader.php:
##########
@@ -43,10 +43,37 @@
*/
class AvroIODatumReader
{
+ /**
+ * Default upper bound on the number of items in a single decoded array or
+ * map. The block count of an array or map is read from the (potentially
+ * untrusted or truncated) input and drives allocation of the resulting
+ * collection. Reading a collection that declares more items than this
limit
+ * throws an {@see AvroIOCollectionSizeException} instead of attempting a
+ * potentially huge allocation. Mirrors the Java SDK's collection item
limit.
+ */
+ public const DEFAULT_MAX_COLLECTION_ITEMS = 2147483639; //
Integer.MAX_VALUE - 8, matching the Java SDK
+
+ /**
+ * Name of the environment variable used to override the default maximum
+ * number of items permitted in a single decoded array or map.
+ */
+ public const MAX_COLLECTION_ITEMS_ENV = 'AVRO_MAX_COLLECTION_ITEMS';
+
+ private int $maxCollectionItems;
+
public function __construct(
private ?AvroSchema $writersSchema = null,
private ?AvroSchema $readersSchema = null
) {
+ $this->maxCollectionItems = self::defaultMaxCollectionItems();
+ }
+
+ /**
+ * Set the maximum number of items permitted in a single decoded array or
map.
+ */
+ public function setMaxCollectionItems(int $maxCollectionItems): void
+ {
+ $this->maxCollectionItems = $maxCollectionItems;
}
Review Comment:
Fixed in 3062721d03 — setMaxCollectionItems now throws
InvalidArgumentException for a negative limit, with a test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
