iemejia commented on code in PR #3861:
URL: https://github.com/apache/avro/pull/3861#discussion_r3565150336
##########
lang/py/avro/io.py:
##########
@@ -87,9 +87,10 @@
import collections
import datetime
import decimal
+import io
Review Comment:
Fixed in 957d180: avro/io.py no longer imports the standard library 'io'
(which CodeQL flagged as a self-import). It imports 'os' and uses os.SEEK_END
instead (both equal 2).
##########
lang/py/avro/io.py:
##########
@@ -780,6 +841,22 @@ def read_enum(self, writers_schema:
avro.schema.EnumSchema, readers_schema: avro
def skip_enum(self, writers_schema: avro.schema.EnumSchema, decoder:
BinaryDecoder) -> None:
return decoder.skip_int()
+ @staticmethod
+ def _ensure_collection_available(decoder: BinaryDecoder, count: int,
min_bytes_per_element: int) -> None:
+ """
+ Reject a collection (array or map) block whose declared element count
+ could not be backed by the bytes actually remaining, before iterating.
+ Skipped when the per-element minimum is zero (e.g. an array of nulls)
or
+ when the reader cannot report how many bytes remain.
+ """
+ if count <= 0 or min_bytes_per_element <= 0:
+ return
+ remaining = decoder.bytes_remaining()
+ if remaining is not None and count * min_bytes_per_element > remaining:
+ raise avro.errors.InvalidAvroBinaryEncoding(
+ f"Collection claims {count} elements with at least
{min_bytes_per_element} bytes each, but only {remaining} bytes are available."
+ )
Review Comment:
Fixed in 957d180: _ensure_collection_available now compares count against
remaining // min_bytes_per_element instead of multiplying, avoiding a large
intermediate product for an attacker-controlled count.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
