iemejia commented on code in PR #3860:
URL: https://github.com/apache/avro/pull/3860#discussion_r3566893585
##########
lang/csharp/src/apache/main/IO/BinaryDecoder.cs:
##########
@@ -264,11 +264,72 @@ public void SkipFixed(int len)
// Read p bytes into a new byte buffer
private byte[] read(long p)
{
- byte[] buffer = new byte[p];
+ if (p < 0)
+ {
+ throw new AvroException($"Can not read a negative number of
bytes: {p}");
+ }
+
+ if (p > MaxDotNetArrayLength)
+ {
+ // A .NET array cannot be larger than this; reject with a
+ // consistent AvroException rather than letting new byte[p]
throw
+ // an OverflowException/OutOfMemoryException. Matches
ReadString().
+ throw new AvroException($"Length {p} exceeds the maximum
supported array length");
Review Comment:
Fixed in 1af6c0a84f: reworded the comment to say the guard 'mirrors'
ReadString()'s max-length guard and notes the message differs, rather than
claiming an exact match.
##########
lang/csharp/src/apache/main/Generic/GenericReader.cs:
##########
@@ -501,6 +514,139 @@ protected virtual object ReadMap(object reuse, MapSchema
writerSchema, Schema re
return result;
}
+ /// <summary>
+ /// Minimum number of bytes a single value of the given schema can
occupy
+ /// on the wire. Used to reject an array/map block count that could
not be
+ /// backed by the bytes remaining. A type that can encode to zero bytes
+ /// (null) returns 0, which disables the collection check for it (so an
+ /// array of nulls is not falsely rejected). A depth limit breaks
+ /// self-referencing schemas.
+ /// </summary>
Review Comment:
Fixed in 1af6c0a84f: the summary now notes a zero-byte minimum is returned
not only for null but also for composites that encode to zero bytes (e.g. a
record whose fields are all zero-byte), which disables the bytes-remaining
check (those are bounded by the zero-byte item cap instead).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
