[jira] [Comment Edited] (AVRO-3226) OutOfMemoryException on invalid input for BinaryDecoder.ReadString on NetStandard 2.1+

["Philip Sanetra (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AVRO-3226?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17425617#comment-17425617 ] 

Philip Sanetra edited comment on AVRO-3226 at 10/7/21, 5:12 PM:
----------------------------------------------------------------

I am not sure how the library should prevent this. Should there be a maximum supported string length?

EDIT: I have extended the PR for AVRO-3225 to fix this in a way that the stream also needs to provide that many bytes and not just declare the string length to produce this OutOfMemoryException.


was (Author: psanetra):
I am not sure how the library should prevent this. Should there be a maximum supported string length?

> OutOfMemoryException on invalid input for BinaryDecoder.ReadString on NetStandard 2.1+
> --------------------------------------------------------------------------------------
>
>                 Key: AVRO-3226
>                 URL: https://issues.apache.org/jira/browse/AVRO-3226
>             Project: Apache Avro
>          Issue Type: Bug
>          Components: csharp
>            Reporter: Philip Sanetra
>            Priority: Major
>
> The BinaryDecoder.ReadString() method on NetStandard2.1+ produces an OutOfMemoryException if there is invalid input caused by this code:
>  
> {code:c#}
> int length = ReadInt();
> Span<byte> buffer = length <= StackallocThreshold ? stackalloc byte[length] :                (bufferArray = ArrayPool<byte>.Shared.Rent(length)).AsSpan(0, length);
> {code}
>  
> ArrayPool<byte>.Shared.Rent(length) will cause the exception if ReadInt() returns a big number like int.MaxValue.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)