[
https://issues.apache.org/jira/browse/ORC-403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16618219#comment-16618219
]
ASF GitHub Bot commented on ORC-403:
------------------------------------
Github user omalley commented on a diff in the pull request:
https://github.com/apache/orc/pull/309#discussion_r218244811
--- Diff: c++/src/Reader.cc ---
@@ -498,6 +498,12 @@ namespace orc {
const proto::Stream& stream = currentStripeFooter.streams(i);
uint64_t length = static_cast<uint64_t>(stream.length());
if (static_cast<StreamKind>(stream.kind()) ==
StreamKind::StreamKind_ROW_INDEX) {
+ if (offset + length > fileLength) {
--- End diff --
This check is really good, but it would also be nice to check that the
stream is within the stripe, although you'd need to pass that in also. We could
pass the whole proto::StripeInformation in.
> Should check offsets got from protobuf Objects
> ----------------------------------------------
>
> Key: ORC-403
> URL: https://issues.apache.org/jira/browse/ORC-403
> Project: ORC
> Issue Type: Bug
> Components: C++
> Reporter: Quanlong Huang
> Assignee: Quanlong Huang
> Priority: Major
> Attachments: bad_stripe_info.orc, copy7_000000_0
>
>
> A malformed ORC file may have a postscript length larger than the file size,
> which causes orc:: readPostscript to read unexpected data.
> {code:java}
> std::unique_ptr<proto::PostScript> postscript =
> std::unique_ptr<proto::PostScript>(new proto::PostScript());
> if (!postscript->ParseFromArray(ptr + readSize - 1 - postscriptSize,
> static_cast<int>(postscriptSize))) {
> throw ParseError("Failed to parse the postscript from " +
> stream->getName());
> }
> {code}
> We should make sure readSize - 1 - postscriptSize >= 0. Furthermore, we
> should check offsets and lengths got from protobuf Objects.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
