You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@avro.apache.org by "Ryan Skraba (Jira)" <ji...@apache.org> on 2021/02/24 15:13:00 UTC
[jira] [Resolved] (AVRO-3049) Java: BinaryDecoder lacks checks on
bytes array length
[ https://issues.apache.org/jira/browse/AVRO-3049?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ryan Skraba resolved AVRO-3049.
-------------------------------
Resolution: Fixed
Thanks for the contribution, especially for documenting these system properties in the Javadoc.
> Java: BinaryDecoder lacks checks on bytes array length
> ------------------------------------------------------
>
> Key: AVRO-3049
> URL: https://issues.apache.org/jira/browse/AVRO-3049
> Project: Apache Avro
> Issue Type: Bug
> Components: java
> Reporter: John Karp
> Assignee: John Karp
> Priority: Major
> Fix For: 1.11.0, 1.10.2
>
>
> There are several checks on string length in BinaryDecoder. However, it lacks the same checks for byte arrays.
> * Negative lengths lead to IllegalArgumentException instead of org.apache.avro.AvroRuntimeException
> * Pathologically large (however legal) arrays can be allocated. Some applications will be suffer denial of service if they are forced to allocate 1 GB arrays repeatedly.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)