RyanSkraba commented on code in PR #3861:
URL: https://github.com/apache/avro/pull/3861#discussion_r3610638326
##########
lang/py/avro/io.py:
##########
@@ -246,6 +286,11 @@ def read_long(self) -> int:
n = b & 0x7F
shift = 7
while (b & 0x80) != 0:
+ # A 64-bit value needs at most 10 bytes (shifts 0..63); reject an
+ # overlong varint rather than accepting a malformed, arbitrarily
+ # large value.
+ if shift >= 70:
+ raise avro.errors.InvalidAvroBinaryEncoding("Varint is too
long")
b = ord(self.read(1))
n |= (b & 0x7F) << shift
shift += 7
Review Comment:
Oooh, I think we accept values with more than 10 bytes with left-padded
zeros. I don't think the spec requires us to minimize the number of bytes that
a varint uses, and I'm not sure Java checks (for example).
We probably should require eliminating left padded zero bits in the spec so
that integers and longs are encoded deterministically! Can you take a look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
