arib06 opened a new pull request, #3893: URL: https://github.com/apache/avro/pull/3893
## What is the purpose of the change `ResolverSchema` / `ResolvingReader` is the path used to read a datum written with an older writer schema into an `avrogencpp`-generated struct, so both the writer schema and the bytes come from the data file. The union branch index and the enum ordinal are plain zigzag varints in that datum, and `Reader` is `ReaderImpl<NullValidator>`, so nothing upstream range-checks them before `Resolver.cc` uses them to index `resolvers_`, `choiceMapping_` and `mapping_`. Two bytes (`90 4e`) select branch 5000 of a two-branch union; the out-of-bounds `Resolver*` that comes back is then virtual-dispatched. The enum site did have a bound, but as an `assert`, which Release builds drop with `-DNDEBUG`, and there the out-of-bounds heap word is also copied into the caller's deserialized object. I hit this while feeding malformed datums through the resolving reader under ASan, which reports a heap-buffer-overflow read of 8 bytes at `Resolver.cc:332` and `Resolver.cc:312`. The check now lives next to each index, next to where the value is read, so all four resolver variants reject the branch instead of trusting it. ## Verifying this change This change added tests and can be verified as follows: - Added `TestBadStuff::testOutOfRangeUnionIndex` and `TestBadStuff::testOutOfRangeEnumIndex` in `test/unittest.cc`, which drive a resolving reader with an out-of-range branch index and ordinal and expect `avro::Exception`. Without the patch `./build/unittest` dies with a memory access violation in the first of them. - `./build.sh test` and a `CMAKE_BUILD_TYPE=Release` build both pass. ## Documentation - Does this pull request introduce a new feature? no -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
