[jira] [Created] (AVRO-4344) [C] avro_schema_enum_get returns an uninitialized pointer for an out-of-range enum index

["Ismaël Mejía (Jira)" <ji...@apache.org>]

Ismaël Mejía created AVRO-4344:
----------------------------------

             Summary: [C] avro_schema_enum_get returns an uninitialized pointer for an out-of-range enum index
                 Key: AVRO-4344
                 URL: https://issues.apache.org/jira/browse/AVRO-4344
             Project: Apache Avro
          Issue Type: Bug
          Components: c
            Reporter: Ismaël Mejía
             Fix For: 1.13.0


{{avro_schema_enum_get()}} (lang/c/src/schema.c:534) calls {{st_lookup()}} but ignores its return value:

{code:c}
const char *avro_schema_enum_get(const avro_schema_t enump, int index)
{
    union {
        st_data_t data;
        char *sym;
    } val;
    st_lookup(avro_schema_to_enum(enump)->symbols, index, &val.data);
    return val.sym;   /* val.sym is uninitialized when st_lookup() fails */
}
{code}

When decoding binary data, the enum ordinal is read directly from the input as a {{long}} and passed through without checking it against the number of declared symbols (lang/c/src/value-read.c:330, the {{AVRO_ENUM}} case -> {{avro_value_set_enum}}).

If the ordinal is out of range - for example from a malformed or truncated container file - {{st_lookup()}} (lang/c/src/st.c:235) returns 0 without writing to {{val.data}}, so {{avro_schema_enum_get()}} returns an uninitialized stack value as a {{char *}}. A caller that then uses that pointer (e.g. {{avropipe}} calling {{strlen()}} on the returned symbol name) reads through an indeterminate pointer and typically crashes with SIGSEGV on a default CMake Release build.

*Steps to reproduce:* change the enum ordinal in a small Avro container file to a value outside the schema's symbol range and read it with {{avropipe}} (or any reader that resolves the symbol name).

*Affected:* 1.12.0 and current main (both functions are byte-identical).

*Suggested fix:*
* Validate the decoded enum index against the number of symbols when reading, and return a normal EINVAL/parse error for an out-of-range index instead of continuing.
* Make {{avro_schema_enum_get()}} check the {{st_lookup()}} return value and return NULL (callers handling NULL) rather than an uninitialized pointer.

Reported by Mahdi Alhakim.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)