Ismaël Mejía created AVRO-4279:
----------------------------------
Summary: [c] Bound collection size when decoding arrays and maps
Key: AVRO-4279
URL: https://issues.apache.org/jira/browse/AVRO-4279
Project: Apache Avro
Issue Type: Sub-task
Components: c
Affects Versions: 1.13.0
Reporter: Ismaël Mejía
{{read_array_value()}} and {{read_map_value()}} in {{lang/c/src/value-read.c}}
loop {{for (i = 0; i < block_count; i++)}} using the block count read from
input, appending one element per iteration. The count is not checked against
any limit, and for negative blocks the accompanying block size is read but not
used to bound the count. The {{int64_t}} count is also cast to {{size_t}}
without range checks.
Add a configurable upper bound on the block count (validated per block and
across blocks) before the loop, and reject negative/overflowing counts with a
decode error. Add a test for a small input declaring an oversized block count.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
