iemejia commented on code in PR #3862:
URL: https://github.com/apache/avro/pull/3862#discussion_r3567432677
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -64,8 +75,14 @@ def read_long
b = byte!
n = b & 0x7F
shift = 7
+ # An Avro long is a 64-bit zig-zag varint, at most 10 bytes. Bound the
+ # continuation chain so a malicious input cannot force unbounded
Integer
+ # growth (and heavy CPU/memory use) before any caller-side check runs.
+ count = 1
while (b & 0x80) != 0
+ raise AvroError, "Varint is too long" if count >= 10
b = byte!
+ count += 1
n |= (b & 0x7F) << shift
shift += 7
end
Review Comment:
Fixed — skip_long now enforces the same 10-byte bound as read_long and
raises AvroError on an overlong continuation chain, so skipping a long field
can't be used to force scanning unbounded input.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
