avro-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Douglas Creager (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (AVRO-1237) Avro-C segfaults when union discriminant out of bounds
Date Fri, 26 Jul 2013 13:23:48 GMT

     [ https://issues.apache.org/jira/browse/AVRO-1237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel

Douglas Creager updated AVRO-1237:

    Attachment: 0001-AVRO-1237.-C-Verify-union-discriminant-when-reading-.patch

Here is a patch that performs the bounds check in the file-reading code.  Turns out it wasn't
as horrible as I thought.  This patch means that we call avro_value_get_schema every time
we read in a union value, but that function is really quick since it returns an existing schema
instance in most cases.
> Avro-C segfaults when union discriminant out of bounds
> ------------------------------------------------------
>                 Key: AVRO-1237
>                 URL: https://issues.apache.org/jira/browse/AVRO-1237
>             Project: Avro
>          Issue Type: Bug
>          Components: c
>         Environment: Avro-C 1.7.2
> Ubuntu 12.04 x86_64
>            Reporter: Michael Cooper
>         Attachments: 0001-AVRO-1237.-C-Verify-union-discriminant-when-reading-.patch,
0001-Check-union-discriminant-bounds-in-both-directions.patch, 0001-Test-case-for-AVRO-1237.patch,
avro-1237-bad-union-discriminant.avro, avro-1237-good.avro
> libavro will segfault when decrypting a specially crafted (or corrupted) avro file when
the discriminant is out of bounds.
> There is already a check for < 0, but there is no upper bounds check.
> I have attached a patch that checks the bounds.

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

View raw message