arib06 opened a new pull request, #3877:
URL: https://github.com/apache/avro/pull/3877
## What is the purpose of the change
`NodeRecord::defaultValueAt` returns `fieldsDefaultValues_[index]` with no
bounds check. A record reader schema constructed through the public
programmatic API (`RecordSchema::addField`) never populates
`fieldsDefaultValues_`, so that vector stays empty while the record gains
leaves. During schema resolution, when a data file's writer schema omits a
field that the reader schema declares,
`ResolvingGrammarGenerator::resolveRecords` calls `reader->defaultValueAt(ri)`
to fetch the reader field's default and reads past the empty vector. The
out-of-bounds `GenericDatum` is then dereferenced by `getAvroBinary` /
`GenericWriter::write` (`GenericDatum::isUnion`), which is an out-of-bounds
read that crashes. Because the writer schema is attacker-controlled bytes
inside the data file header, opening such a file with a programmatically-built
reader schema is enough to trigger it. I hit it while reading a corpus file
whose writer had dropped a field. The base `Node::defaultValueAt` already th
rows `Exception("No default value at")` for this case, and the sibling
`customAttributesAt` already guards its index the same way, so this brings
`defaultValueAt` in line with both. A missing reader default now surfaces as a
normal resolution error instead of a memory fault.
## Verifying this change
This change added tests and can be verified as follows:
- Added a schema test that builds a reader record via
`RecordSchema::addField` with a field absent from the writer schema and asserts
that `resolvingDecoder` throws `Exception`. It crashes (SEGV, confirmed under
ASan) on the current code and passes with the fix.
## Documentation
- Does this pull request introduce a new feature? no
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
