[
https://issues.apache.org/jira/browse/AVRO-4241?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102836#comment-18102836
]
ASF subversion and git services commented on AVRO-4241:
-------------------------------------------------------
Commit 2210a460a373f0fbf0c93cf5775a9bc682f61c53 in avro's branch
refs/heads/AVRO-4295-csharp-available-bytes from Ismaël Mejía
[ https://gitbox.apache.org/repos/asf?p=avro.git;h=2210a460a3 ]
AVRO-4295: [csharp] Validate available bytes before allocating for
length-prefixed values and collections
A bytes or string value is a length prefix followed by that many bytes, and an
array or map block is an element count followed by that many items. A malicious
or truncated input can declare a huge length or count with little or no data.
- BinaryDecoder.RemainingBytes() reports the bytes still readable for a seekable
stream (or -1). ReadBytes and both ReadString implementations reject an
over-large declared length before allocating.
- DefaultReader.ReadArray/ReadMap reject a block whose element count could not
be
backed by the bytes remaining, using MinBytesPerElement() computed from the
element schema so a zero-byte element type (e.g. null) is not falsely
rejected.
The count is checked on the raw long before the int cast, which also avoids
the cast overflowing into a bogus pre-allocation.
Mirrors the Java SDK's checks (AVRO-4241). Non-seekable streams and non-binary
decoders are unaffected.
Assisted-by: GitHub Copilot:claude-opus-4.8
> [java] BinaryDecoder should verify available bytes before reading
> -----------------------------------------------------------------
>
> Key: AVRO-4241
> URL: https://issues.apache.org/jira/browse/AVRO-4241
> Project: Apache Avro
> Issue Type: Sub-task
> Components: java
> Affects Versions: 1.11.5, 1.12.1
> Reporter: Ismaël Mejía
> Assignee: Ismaël Mejía
> Priority: Blocker
> Labels: pull-request-available
> Fix For: 1.12.2
>
> Time Spent: 3h
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
