Copilot commented on code in PR #3859:
URL: https://github.com/apache/avro/pull/3859#discussion_r3567394543
##########
lang/c++/impl/BinaryDecoder.cc:
##########
@@ -163,8 +206,22 @@ size_t BinaryDecoder::arrayStart() {
size_t BinaryDecoder::doDecodeItemCount() {
auto result = doDecodeLong();
if (result < 0) {
+ // INT64_MIN cannot be negated in int64_t (it would overflow); reject
it
+ // rather than propagating 2^63 as an item count that inevitably fails
a
+ // huge allocation downstream.
+ if (result == INT64_MIN) {
+ throw Exception("Invalid negative block count: {}", result);
+ }
doDecodeLong();
- return static_cast<size_t>(-(result + 1)) + 1;
+ result = -result;
Review Comment:
When decoding a negative array/map block count, Avro encoding includes a
following block byte-size long that should be non-negative. doDecodeItemCount()
currently reads that long but ignores its value, so a malformed negative block
byte-size is silently accepted (whereas skipArray() correctly rejects it). This
should be validated here too so arrayStart()/arrayNext()/mapStart()/mapNext()
reject malformed inputs consistently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
