iemejia commented on code in PR #3859:
URL: https://github.com/apache/avro/pull/3859#discussion_r3567430517
##########
lang/c++/impl/BinaryDecoder.cc:
##########
@@ -163,8 +206,22 @@ size_t BinaryDecoder::arrayStart() {
size_t BinaryDecoder::doDecodeItemCount() {
auto result = doDecodeLong();
if (result < 0) {
+ // INT64_MIN cannot be negated in int64_t (it would overflow); reject
it
+ // rather than propagating 2^63 as an item count that inevitably fails
a
+ // huge allocation downstream.
+ if (result == INT64_MIN) {
+ throw Exception("Invalid negative block count: {}", result);
+ }
doDecodeLong();
- return static_cast<size_t>(-(result + 1)) + 1;
+ result = -result;
Review Comment:
This is already handled as of commit 4f4f8f4de6: doDecodeItemCount now reads
the block byte-size into `blockSize` and throws `Exception("Invalid negative
block byte-size")` when it is < 0, so
arrayStart()/arrayNext()/mapStart()/mapNext() reject it consistently with
skipArray().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
