iemejia commented on code in PR #3859:
URL: https://github.com/apache/avro/pull/3859#discussion_r3567412550
##########
lang/c++/impl/BinaryDecoder.cc:
##########
@@ -163,8 +206,22 @@ size_t BinaryDecoder::arrayStart() {
size_t BinaryDecoder::doDecodeItemCount() {
auto result = doDecodeLong();
if (result < 0) {
+ // INT64_MIN cannot be negated in int64_t (it would overflow); reject
it
+ // rather than propagating 2^63 as an item count that inevitably fails
a
+ // huge allocation downstream.
+ if (result == INT64_MIN) {
+ throw Exception("Invalid negative block count: {}", result);
+ }
doDecodeLong();
- return static_cast<size_t>(-(result + 1)) + 1;
+ result = -result;
+ }
Review Comment:
Fixed — doDecodeItemCount now reads the block byte-size into a variable and
rejects a negative value (matching skipArray), so arrayStart()/mapStart() fail
fast on corrupt input.
##########
lang/c++/impl/BinaryDecoder.cc:
##########
@@ -109,12 +138,25 @@ size_t BinaryDecoder::doDecodeLength() {
return len;
}
+void BinaryDecoder::checkAvailableBytes(size_t len) {
+ // Reject a declared length that exceeds the data actually available before
+ // allocating for it, to guard against an out-of-memory attack from a
+ // malicious or truncated input. Only enforced when the stream can report
+ // how many bytes remain.
+ int64_t remaining = in_.remainingBytes();
+ if (remaining >= 0 && static_cast<uint64_t>(len) >
static_cast<uint64_t>(remaining)) {
+ throw Exception(
+ "Length {} exceeds the {} bytes available in the stream", len,
remaining);
+ }
+}
+
void BinaryDecoder::drain() {
in_.drain(false);
}
void BinaryDecoder::decodeString(std::string &value) {
size_t len = doDecodeLength();
+ checkAvailableBytes(len);
value.resize(len);
Review Comment:
Fixed — skipString now calls checkAvailableBytes(len) before skipping, so a
length exceeding the known remaining bytes is rejected instead of being
silently clamped at EOF by InputStream::skip.
##########
lang/c++/impl/BinaryDecoder.cc:
##########
@@ -130,6 +172,7 @@ void BinaryDecoder::skipString() {
void BinaryDecoder::decodeBytes(std::vector<uint8_t> &value) {
size_t len = doDecodeLength();
+ checkAvailableBytes(len);
value.resize(len);
Review Comment:
Fixed — skipBytes likewise calls checkAvailableBytes(len), consistent with
decodeBytes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
