Copilot commented on code in PR #3863:
URL: https://github.com/apache/avro/pull/3863#discussion_r3566948635
##########
lang/php/lib/Datum/AvroIODatumReader.php:
##########
@@ -312,14 +342,27 @@ public function readMap(
AvroIOBinaryDecoder $decoder
): array {
$items = [];
+ $minBytes = 1 + self::minBytesPerElement($writersSchema->values());
+ $read = 0; // Cumulative pairs read; count($items) would undercount
duplicate keys.
$pair_count = $decoder->readLong();
while (0 != $pair_count) {
if ($pair_count < 0) {
+ // PHP_INT_MIN cannot be negated: -PHP_INT_MIN promotes to a
+ // float, so reject it rather than propagating a non-int count.
+ if (PHP_INT_MIN == $pair_count) {
+ throw new AvroException('Invalid map block count');
+ }
$pair_count = -$pair_count;
// Note: we're not doing anything with block_size other than
skipping it
$decoder->readLong();
Review Comment:
When decoding a negative map block count, the subsequent block-size long is
read and ignored without validating that it is non-negative. This is
inconsistent with skipMap(), which rejects negative block sizes, and it allows
malformed inputs to proceed further than necessary.
##########
lang/php/lib/Datum/AvroIODatumReader.php:
##########
@@ -284,12 +307,19 @@ public function readArray(
AvroIOBinaryDecoder $decoder
): array {
$items = [];
+ $minBytes = self::minBytesPerElement($writersSchema->items());
$blockCount = $decoder->readLong();
- while (0 !== $blockCount) {
+ while (0 != $blockCount) {
if ($blockCount < 0) {
+ // PHP_INT_MIN cannot be negated: -PHP_INT_MIN promotes to a
+ // float, so reject it rather than propagating a non-int count.
+ if (PHP_INT_MIN == $blockCount) {
+ throw new AvroException('Invalid array block count');
+ }
$blockCount = -$blockCount;
$decoder->readLong(); // Read (and ignore) block size
Review Comment:
When decoding a negative array block count, the following block-size long is
currently read and ignored without validating that it is non-negative. The skip
path rejects negative block sizes, and Avro binary encoding specifies block
size as a byte count, so a negative value should be treated as malformed input
and rejected early for consistency and robustness.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
