Copilot commented on code in PR #3859:
URL: https://github.com/apache/avro/pull/3859#discussion_r3567637499
##########
lang/c++/include/avro/GenericDatum.hh:
##########
@@ -244,6 +244,9 @@ public:
* \param branch The index for the selected branch.
*/
void selectBranch(size_t branch) {
+ if (branch >= schema()->leaves()) {
+ throw Exception("Union branch index out of range: must be less
than " + std::to_string(schema()->leaves()) + ", but is " +
std::to_string(branch));
+ }
Review Comment:
GenericUnion::selectBranch() now checks branch < schema()->leaves(), but at
least BinaryDecoder::decodeUnionIndex() returns
`static_cast<size_t>(doDecodeLong())` without validating the decoded long. On
platforms where size_t is narrower than int64_t (e.g. 32-bit), a large on-wire
union index (e.g. 2^32) can truncate to a small in-range value and bypass this
new guard, selecting the wrong union branch instead of rejecting malformed
input. Consider validating the decoded union index at decode time (reject idx <
0 and reject values that don’t fit into size_t before casting) so out-of-range
indices can’t be “normalized” by truncation/wraparound.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
