arib06 commented on PR #3904: URL: https://github.com/apache/avro/pull/3904#issuecomment-6044773124
@martin-g @RyanSkraba you two have handled the recent lang/c fixes, so tagging you for a look here (per @uros-b above). It's a single bounds check in `avro_resolver_union_branch`: the deprecated consumer path indexed `child_resolvers` with the raw wire discriminant, so discriminant 100 on a two-branch union read past the array and `avro_consume_binary` dispatched through whatever pointer came back (ASAN reports a heap-buffer-overflow READ at `resolver.c:1119`). The value decoder already rejects out-of-range discriminants, only this older path was missed. Test is included and the branch is still clean against main. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
