You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@avro.apache.org by "John Karp (Jira)" <ji...@apache.org> on 2021/02/22 16:02:00 UTC

[jira] [Commented] (AVRO-3049) Java: BinaryDecoder lacks checks on bytes array length

    [ https://issues.apache.org/jira/browse/AVRO-3049?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17288450#comment-17288450 ] 

John Karp commented on AVRO-3049:
---------------------------------

PR: https://github.com/apache/avro/pull/1098

> Java: BinaryDecoder lacks checks on bytes array length
> ------------------------------------------------------
>
>                 Key: AVRO-3049
>                 URL: https://issues.apache.org/jira/browse/AVRO-3049
>             Project: Apache Avro
>          Issue Type: Bug
>          Components: java
>            Reporter: John Karp
>            Assignee: John Karp
>            Priority: Major
>
> There are several checks on string length in BinaryDecoder. However, it lacks the same checks for byte arrays.
>  * Negative lengths lead to IllegalArgumentException instead of org.apache.avro.AvroRuntimeException
>  * Pathologically large (however legal) arrays can be allocated. Some applications will be suffer denial of service if they are forced to allocate 1 GB arrays repeatedly.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)