[jira] [Resolved] (AVRO-4279) [c] Bound collection size when decoding arrays and maps

["Ismaël Mejía (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/AVRO-4279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ismaël Mejía resolved AVRO-4279.
--------------------------------
    Resolution: Duplicate

Superseded by AVRO-4293. The collection block-count cap for [c] has been folded into that issue's fix (PR https://github.com/apache/avro/pull/3858), which now provides a single complete protection against collection allocation DoS: available-bytes validation, a heap-aware cap for zero-byte-element collections, a structural cap, and bounded skip paths. Resolving this as a duplicate/superseded; the PR here (closed) is superseded by #3858.

> [c] Bound collection size when decoding arrays and maps
> -------------------------------------------------------
>
>                 Key: AVRO-4279
>                 URL: https://issues.apache.org/jira/browse/AVRO-4279
>             Project: Apache Avro
>          Issue Type: Sub-task
>          Components: c
>    Affects Versions: 1.11.5, 1.12.1
>            Reporter: Ismaël Mejía
>            Assignee: Ismaël Mejía
>            Priority: Major
>              Labels: pull-request-available
>             Fix For: 1.12.2
>
>          Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> {{read_array_value()}} and {{read_map_value()}} in {{lang/c/src/value-read.c}} loop {{for (i = 0; i < block_count; i++)}} using the block count read from input, appending one element per iteration. The count is not checked against any limit, and for negative blocks the accompanying block size is read but not used to bound the count. The {{int64_t}} count is also cast to {{size_t}} without range checks.
> Add a configurable upper bound on the block count (validated per block and across blocks) before the loop, and reject negative/overflowing counts with a decode error. Add a test for a small input declaring an oversized block count.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)