[
https://issues.apache.org/jira/browse/AVRO-4287?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ismaël Mejía reassigned AVRO-4287:
----------------------------------
Assignee: Ismaël Mejía
> [javascript] Enforce a maximum decompressed block size
> ------------------------------------------------------
>
> Key: AVRO-4287
> URL: https://issues.apache.org/jira/browse/AVRO-4287
> Project: Apache Avro
> Issue Type: Sub-task
> Components: javascript
> Affects Versions: 1.11.5, 1.12.1
> Reporter: Ismaël Mejía
> Assignee: Ismaël Mejía
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.12.2
>
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> {{BlockDecoder}} in {{lang/js/lib/files.js}} decompresses deflate blocks with
> {{zlib.inflateRaw}} and does not pass Node's {{maxOutputLength}} option, so
> the decompressed output is unbounded.
> Enforce a configurable maximum decompressed size (e.g. via
> {{maxOutputLength}} and equivalent handling for custom codecs) and fail
> decoding with a clear error when a block would exceed it. Add a test with a
> high-ratio block.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
