Copilot commented on code in PR #3862:
URL: https://github.com/apache/avro/pull/3862#discussion_r3565092772
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -103,10 +110,28 @@ def read_string
end
def read(len)
- # Read n bytes
+ # Read n bytes. Reject a declared length that exceeds the bytes
+ # actually remaining before allocating for it, to guard against an
+ # out-of-memory attack from a malicious or truncated input. The check
+ # is only applied to larger reads; smaller reads and stream readers
that
Review Comment:
`BinaryDecoder#read` accepts `len` directly from the stream (e.g.,
bytes/string length prefix). If a malicious input encodes a negative length,
Ruby IO treats `read(-1)` as “read the rest of the stream”, which can cause an
unexpected large allocation and bypass the new size check (since `len >
MAX_UNCHECKED_READ` will be false). Reject negative lengths before calling
`@reader.read`.
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -496,6 +524,43 @@ def skip_record(writers_schema, decoder)
end
private
+ # Minimum number of bytes a single value of the given schema can occupy
on
+ # the wire. Used to reject an array/map block count that could not be
+ # backed by the bytes remaining. A type that can encode to zero bytes
+ # (null) returns 0, which disables the check for it (so an array of nulls
+ # is not falsely rejected).
+ def min_bytes_per_element(schema, visited = nil)
+ visited ||= {}.compare_by_identity
+ case schema.type_sym
+ when :null then 0
+ when :float then 4
+ when :double then 8
+ when :fixed then schema.size
+ when :record, :error
Review Comment:
`min_bytes_per_element` treats `:record`/`:error` specially, but not
`:request` even though request schemas are record-like and are handled
alongside records elsewhere in this file. Overestimating `:request` as
at-least-1-byte can falsely reject arrays/maps of request values (e.g., request
records whose fields encode to 0 bytes). Include `:request` in the record-like
branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
