iemejia commented on code in PR #3862:
URL: https://github.com/apache/avro/pull/3862#discussion_r3567461054
##########
lang/ruby/lib/avro/io.rb:
##########
@@ -64,8 +75,14 @@ def read_long
b = byte!
n = b & 0x7F
shift = 7
+ # An Avro long is a 64-bit zig-zag varint, at most 10 bytes. Bound the
+ # continuation chain so a malicious input cannot force unbounded
Integer
+ # growth (and heavy CPU/memory use) before any caller-side check runs.
+ count = 1
while (b & 0x80) != 0
+ raise AvroError, "Varint is too long" if count >= 10
b = byte!
+ count += 1
n |= (b & 0x7F) << shift
Review Comment:
Fixed — read_long now rejects the 10th byte if any payload bit above bit 63
is set (`count == 10 && (b & 0x7E) != 0`), so a 10-byte encoding outside the
64-bit range is rejected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
