kalt2212 opened a new pull request, #4034:
URL: https://github.com/apache/avro/pull/4034
## Summary
Fixes a signed integer overflow / denial of service in the Apache Avro C
SDK's array and map value readers.
## Details
In `read_array_value()` and `read_map_value()` (`lang/c/src/value-read.c`),
a negative `block_count` from the wire is negated with `block_count * -1`. When
`block_count == INT64_MIN`, the negation is undefined behavior; in practice the
value stays negative (or wraps), and the subsequent `while (block_count != 0)`
loop iterates ~2^63 times, hanging the process on just 11 bytes of input (a
trivial remote DoS).
The patch rejects `INT64_MIN` explicitly with `avro_set_error("Invalid array
block count")` / `avro_set_error("Invalid map block count")` and returns
`EINVAL`, mirroring how other invalid encodings are handled.
## Testing
- PoC verified before the fix: 11-byte input with `block_count = INT64_MIN`
hangs the process; after the fix it returns `EINVAL` immediately.
- Existing C SDK test suite passes.
**AI tool use disclosure:** AI was used in part for code audit and patch
drafting.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
