ArjunD3456 opened a new pull request, #4046: URL: https://github.com/apache/avro/pull/4046
## What is the purpose of the change `is_avro_id` in `lang/c/src/schema.c` validates a schema's name by calling `isalpha`/`isdigit` on a plain `char`. Where `char` is signed (the default on x86-64 and ARM), a name byte of `0x80` or higher is sign extended to a negative `int`. Passing a negative value other than `EOF` to the ctype functions is undefined behavior (C11 7.4p1 requires the argument to be representable as `unsigned char` or equal `EOF`), and on a libc whose ctype table is not offset for negative indices it reads out of bounds. Schema names reach `is_avro_id` straight from the `avro.schema` JSON in a container file header, so the bytes are attacker controlled. `print_bytes_value` in `lang/c/src/avropipe.c` has the same shape, calling `isprint` on a `char` taken from a decoded bytes, string, fixed, or enum value. Both now cast to `unsigned char` at the call, which is the standard way to use these functions. `lang/c/src/dump.c` already masks with `0x7f` so it is unaffected. ## Verifying this change This change is a code cleanup without new test coverage. Behavior is unchanged for valid input: an ASCII name validates as before, and a name with a byte >= 0x80 is still rejected since it is not alpha, digit, or underscore. The existing `schema_tests` cases continue to exercise name validation. To confirm the out-of-bounds read I modeled the `is_avro_id` table lookup in a standalone program and built it with AddressSanitizer: a name whose first byte is `0xC3` produced a `global-buffer-overflow` read on the table index before the cast, and the build is clean after it. ## Documentation - Does this pull request introduce a new feature? no -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
