Copilot commented on code in PR #3861:
URL: https://github.com/apache/avro/pull/3861#discussion_r3568464169
##########
lang/py/avro/io.py:
##########
@@ -795,23 +994,55 @@ def read_array(self, writers_schema:
avro.schema.ArraySchema, readers_schema: av
The actual count in this case
is the absolute value of the count written.
"""
- read_items = []
+ read_items: List[object] = []
+ min_bytes = _min_bytes_per_element(writers_schema.items)
+ zero_byte_limit, structural_limit = _collection_limits()
block_count = decoder.read_long()
while block_count != 0:
if block_count < 0:
block_count = -block_count
decoder.skip_long()
+ self._ensure_collection_available(decoder, len(read_items),
block_count, min_bytes, zero_byte_limit, structural_limit)
for i in range(block_count):
read_items.append(self.read_data(writers_schema.items,
readers_schema.items, decoder))
block_count = decoder.read_long()
return read_items
+ @staticmethod
+ def _skip_block_bytes(decoder: BinaryDecoder, block_size: int,
block_count: int, min_bytes: int) -> None:
+ """Skip a sized-block's byte count, rejecting malformed sizes.
+
+ The block_size is attacker-controlled: a negative value would seek
+ backwards and an oversized value past EOF, either corrupting the
decoder
+ position. Also require that block_size can plausibly hold block_count
+ elements at their minimum on-wire size, so a too-small size cannot
+ misalign the decoder. Reject before skipping.
+ """
+ if block_size < 0:
+ raise avro.errors.InvalidAvroBinaryEncoding(f"Invalid negative
block size: {block_size}")
+ remaining = decoder.bytes_remaining()
+ if remaining is not None and block_size > remaining:
+ raise avro.errors.InvalidAvroBinaryEncoding(f"Block size
{block_size} exceeds the {remaining} bytes remaining")
+ if min_bytes > 0 and block_count > block_size // min_bytes:
+ raise avro.errors.InvalidAvroBinaryEncoding(f"Block size
{block_size} is too small for {block_count} elements of >= {min_bytes} bytes")
+ decoder.skip(block_size)
Review Comment:
`_skip_block_bytes()` calls `decoder.skip(block_size)` directly. If the
underlying reader rejects the seek (e.g., oversized offset, invalid seek, or
other IO error), this can raise `OSError`/`ValueError`/`OverflowError` (or
similar) instead of an Avro exception, leaking an unexpected error type to
callers. Consider wrapping the skip and re-raising as
`InvalidAvroBinaryEncoding` for consistent failure semantics on malformed sized
blocks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
