iemejia commented on code in PR #3862:
URL: https://github.com/apache/avro/pull/3862#discussion_r3565150638
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -103,10 +110,28 @@ def read_string
end
def read(len)
- # Read n bytes
+ # Read n bytes. Reject a declared length that exceeds the bytes
+ # actually remaining before allocating for it, to guard against an
+ # out-of-memory attack from a malicious or truncated input. The check
+ # is only applied to larger reads; smaller reads and stream readers
that
Review Comment:
Fixed in d4eec59: BinaryDecoder#read now rejects a negative length (Ruby
IO#read(-1) reads the rest of the stream, which would bypass the size check).
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -496,6 +524,43 @@ def skip_record(writers_schema, decoder)
end
private
+ # Minimum number of bytes a single value of the given schema can occupy
on
+ # the wire. Used to reject an array/map block count that could not be
+ # backed by the bytes remaining. A type that can encode to zero bytes
+ # (null) returns 0, which disables the check for it (so an array of nulls
+ # is not falsely rejected).
+ def min_bytes_per_element(schema, visited = nil)
+ visited ||= {}.compare_by_identity
+ case schema.type_sym
+ when :null then 0
+ when :float then 4
+ when :double then 8
+ when :fixed then schema.size
+ when :record, :error
Review Comment:
Fixed in d4eec59: min_bytes_per_element now treats :request like
:record/:error, so an array/map of request values whose fields encode to zero
bytes is not falsely rejected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
