Copilot commented on code in PR #3864:
URL: https://github.com/apache/avro/pull/3864#discussion_r3565825519
##########
lang/perl/lib/Avro/BinaryDecoder.pm:
##########
@@ -220,8 +339,16 @@ sub skip_block {
my $block_count = decode_long($class, undef, undef, $reader);
while ($block_count) {
if ($block_count < 0) {
- $reader->seek($block_count, 0);
- next;
+ # A negative count is followed by a long block size in bytes, which
+ # lets the whole block be skipped without decoding each item. Skip
+ # forward by that many bytes relative to the current position
+ # (SEEK_CUR); whence 0 (SEEK_SET) would seek to an absolute (here
+ # nonsensical) offset. A failed seek is treated as fatal.
+ my $block_size = decode_long($class, undef, undef, $reader);
+ unless ($reader->seek($block_size, 1)) {
+ throw Avro::Schema::Error::Parse(
+ "Failed to skip block of $block_size bytes");
+ }
Review Comment:
In skip_block's negative-count path, the decoded block-size long is not
validated. If a corrupted input provides a negative block size,
seek($block_size, SEEK_CUR) can move the reader backwards (or otherwise behave
unexpectedly) and potentially cause an infinite loop or mis-decoding. Block
size should be rejected when negative, and (optionally) checked against
remaining bytes before seeking.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
