arib06 opened a new pull request, #3876: URL: https://github.com/apache/avro/pull/3876
## What is the purpose of the change `read_enum`, `read_union` and `skip_union` in the Python binary decoder read the enum symbol index / union branch index from the wire and validate it with an upper-bound-only check (`index >= len(...)`). A negative index is not caught. Because the index is then used directly to subscript `writers_schema.symbols` / `writers_schema.schemas`, and Python lists accept negative subscripts, a crafted negative zigzag index passes validation and wraps to an element counted from the end of the list. For an enum this silently returns the wrong symbol; for a union it selects a branch that the writer never declared and decodes the following bytes with that wrong branch schema, which is a decode-time type confusion and desyncs the stream for `skip_union`. Positive out-of-range indices are already rejected, so this only closes the negative side. The check becomes `0 <= index < len(...)` at all three sites. ## Verifying this change This change added tests and can be verified as follows: - Added `test_negative_enum_index` and `test_negative_union_index` in `TestMisc`, feeding a single `0x01` byte (zigzag `-1`) as the index. Both assert `SchemaResolutionException`. Against the unpatched decoder the enum read returns `symbols[-1]` and the union read decodes via `schemas[-1]`, so both tests fail before the fix. - Full `test_io` suite green (152 tests). ## Documentation - Does this pull request introduce a new feature? no -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
