Skip to content

AVRO-4275: [C] Fix signed integer overflow in block_count negation #3842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
iemejia wants to merge 5 commits into from
+424 −6
Closed

AVRO-4275: [C] Fix signed integer overflow in block_count negation #3842

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
271de63
AVRO-4275: [C] Fix signed integer overflow in block_count negation
iemejia Jul 11, 2026
e8b6f74
AVRO-4275: Fix incomplete INT64_MIN overflow guard in block_count neg…
iemejia Jul 11, 2026
35b0bdd
AVRO-4275: [C] Strengthen test assertions to check EINVAL
iemejia Jul 11, 2026
4de7e85
AVRO-4275: [C] Guard INT64_MIN in skip and consumer paths, fix char n…
iemejia Jul 11, 2026
6781661
AVRO-4275: [C] Move INT64_MIN guard before consumer callbacks
iemejia Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions lang/c/src/consume-binary.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,12 +53,16 @@ read_array(avro_reader_t reader, const avro_encoding_t * enc,

check_prefix(rval, enc->read_long(reader, &block_count),
"Cannot read array block count: ");
if (block_count == INT64_MIN) {
avro_set_error("Invalid array block count");
return EINVAL;
}
check(rval, avro_consumer_call(consumer, array_start_block,
1, block_count, ud));

while (block_count != 0) {
if (block_count < 0) {
block_count = block_count * -1;
block_count = -block_count;
check_prefix(rval, enc->read_long(reader, &block_size),
"Cannot read array block size: ");
}
Expand All @@ -77,6 +81,10 @@ read_array(avro_reader_t reader, const avro_encoding_t * enc,

check_prefix(rval, enc->read_long(reader, &block_count),
"Cannot read array block count: ");
if (block_count == INT64_MIN) {
avro_set_error("Invalid array block count");
return EINVAL;
}
check(rval, avro_consumer_call(consumer, array_start_block,
0, block_count, ud));
}
Expand All @@ -96,12 +104,16 @@ read_map(avro_reader_t reader, const avro_encoding_t * enc,

check_prefix(rval, enc->read_long(reader, &block_count),
"Cannot read map block count: ");
if (block_count == INT64_MIN) {
avro_set_error("Invalid map block count");
return EINVAL;
}
check(rval, avro_consumer_call(consumer, map_start_block,
1, block_count, ud));

while (block_count != 0) {
if (block_count < 0) {
block_count = block_count * -1;
block_count = -block_count;
check_prefix(rval, enc->read_long(reader, &block_size),
"Cannot read map block size: ");
}
Expand Down Expand Up @@ -135,6 +147,10 @@ read_map(avro_reader_t reader, const avro_encoding_t * enc,

check_prefix(rval, enc->read_long(reader, &block_count),
"Cannot read map block count: ");
if (block_count == INT64_MIN) {
avro_set_error("Invalid map block count");
return EINVAL;
}
check(rval, avro_consumer_call(consumer, map_start_block,
0, block_count, ud));
}
Expand Down
12 changes: 10 additions & 2 deletions lang/c/src/datum_skip.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,11 @@ static int skip_array(avro_reader_t reader, const avro_encoding_t * enc,

while (block_count != 0) {
if (block_count < 0) {
block_count = block_count * -1;
if (block_count == INT64_MIN) {
avro_set_error("Invalid array block count");
return EINVAL;
}
block_count = -block_count;
check_prefix(rval, enc->read_long(reader, &block_size),
"Cannot read array block size: ");
}
Expand All @@ -63,7 +67,11 @@ static int skip_map(avro_reader_t reader, const avro_encoding_t * enc,
while (block_count != 0) {
int64_t block_size;
if (block_count < 0) {
block_count = block_count * -1;
if (block_count == INT64_MIN) {
avro_set_error("Invalid map block count");
return EINVAL;
}
block_count = -block_count;
check_prefix(rval, enc->read_long(reader, &block_size),
"Cannot read map block size: ");
}
Expand Down
16 changes: 14 additions & 2 deletions lang/c/src/value-read.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,13 @@ read_array_value(avro_reader_t reader, avro_value_t *dest)

while (block_count != 0) {
if (block_count < 0) {
block_count = block_count * -1;
/* Reject INT64_MIN: its negation is not
* representable in int64_t (CWE-190). */
if (block_count == INT64_MIN) {
avro_set_error("Invalid array block count");
return EINVAL;
}
block_count = -block_count;
Comment on lines +56 to +62

@iemejia iemejia Jul 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the PR description to accurately reflect the implementation: explicit INT64_MIN guard returning EINVAL followed by safe -block_count negation.

Comment on lines +56 to +62

@iemejia iemejia Jul 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. Applied the same INT64_MIN guard + safe negation to skip_array/skip_map in datum_skip.c and read_array/read_map in consume-binary.c.

check_prefix(rval, avro_binary_encoding.
read_long(reader, &block_size),
"Cannot read array block size: ");
Expand Down Expand Up @@ -89,7 +95,13 @@ read_map_value(avro_reader_t reader, avro_value_t *dest)

while (block_count != 0) {
if (block_count < 0) {
block_count = block_count * -1;
/* Reject INT64_MIN: its negation is not
* representable in int64_t (CWE-190). */
if (block_count == INT64_MIN) {
avro_set_error("Invalid map block count");
return EINVAL;
}
block_count = -block_count;
check_prefix(rval, avro_binary_encoding.
read_long(reader, &block_size),
"Cannot read map block size: ");
Expand Down
1 change: 1 addition & 0 deletions lang/c/tests/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,3 +88,4 @@ add_avro_test_checkmem(test_avro_1691)
add_avro_test_checkmem(test_avro_1906)
add_avro_test_checkmem(test_avro_1904)
add_avro_test_checkmem(test_avro_4246)
add_avro_test_checkmem(test_avro_4275)
Loading
Loading