iemejia commented on PR #3861: URL: https://github.com/apache/avro/pull/3861#issuecomment-4951284231
This PR now also includes the collection block-count cap for [python], so it is the single complete fix for collection allocation DoS in this SDK. In addition to validating available bytes before allocating length-prefixed values, it bounds the number of array/map items per block: - a heap-aware cap for zero-byte-element collections (e.g. `array<null>`), which otherwise bypass the available-bytes check because each element reads 0 bytes; - a structural cap for all collections; - bounded skip paths so projection/skip cannot loop unboundedly. With this, the standalone collection-limit change for [python] (AVRO-4282, #3845) is redundant and is being closed as superseded by this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
