Copilot commented on code in PR #3862:
URL: https://github.com/apache/avro/pull/3862#discussion_r3567430608
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -64,8 +75,14 @@ def read_long
b = byte!
n = b & 0x7F
shift = 7
+ # An Avro long is a 64-bit zig-zag varint, at most 10 bytes. Bound the
+ # continuation chain so a malicious input cannot force unbounded
Integer
+ # growth (and heavy CPU/memory use) before any caller-side check runs.
+ count = 1
while (b & 0x80) != 0
+ raise AvroError, "Varint is too long" if count >= 10
b = byte!
+ count += 1
n |= (b & 0x7F) << shift
Review Comment:
`BinaryDecoder#read_long` now caps varints to 10 bytes, but it still accepts
10-byte encodings that set bits beyond the 64-bit range (the 10th byte may
legally contain only 0x00 or 0x01). This allows decoding malformed Avro longs
outside the spec’s 64-bit domain; add a range check when `count == 10` to
reject out-of-range encodings.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
