iemejia commented on code in PR #3864:
URL: https://github.com/apache/avro/pull/3864#discussion_r3565838644
##########
lang/perl/lib/Avro/BinaryDecoder.pm:
##########
@@ -220,8 +339,16 @@ sub skip_block {
my $block_count = decode_long($class, undef, undef, $reader);
while ($block_count) {
if ($block_count < 0) {
- $reader->seek($block_count, 0);
- next;
+ # A negative count is followed by a long block size in bytes, which
+ # lets the whole block be skipped without decoding each item. Skip
+ # forward by that many bytes relative to the current position
+ # (SEEK_CUR); whence 0 (SEEK_SET) would seek to an absolute (here
+ # nonsensical) offset. A failed seek is treated as fatal.
+ my $block_size = decode_long($class, undef, undef, $reader);
+ unless ($reader->seek($block_size, 1)) {
+ throw Avro::Schema::Error::Parse(
+ "Failed to skip block of $block_size bytes");
+ }
Review Comment:
Fixed in 8af98bef57: the negative-count path now rejects a negative block
size (throwing Invalid negative block size) before seeking, so a corrupt input
cannot seek the reader backwards into an infinite loop or mis-decode. It also
validates the block size against the bytes remaining via _ensure_available
before the relative seek, consistent with skip_bytes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
