Skip to content

check snappy block length before crc trailer in decode_snappy #3807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dxbjavid wants to merge 4 commits into
base: main
Choose a base branch
from
+93 −0
Open

check snappy block length before crc trailer in decode_snappy #3807

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
efd1ebc
check snappy block length before crc trailer in decode_snappy
Jun 5, 2026
afda797
add test for undersized snappy blocks and fix guard indentation
dxbjavid Jun 22, 2026
e8386ac
Fix formatting of error handling in codec.c
martin-g Jun 22, 2026
844692b
reject snappy block length above SIZE_MAX before decode
dxbjavid Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions lang/c/src/codec.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,11 @@ static int decode_snappy(avro_codec_t c, void * data, int64_t len)
uint32_t crc;
size_t outlen;

if (len < 4) {

@martin-g martin-g Jun 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if (len < 4) {
if (len < 4 || (uint64_t)len > SIZE_MAX) {

len should also be smaller than SIZE_MAX otherwise on 32-bit systems it may overflow when passed to snappy_uncompressed_length() that accepts size_t.

@dxbjavid dxbjavid Jun 23, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point, that 32-bit overflow would slip straight through. added the SIZE_MAX bound to the same guard and pushed. builds fine here with the snappy codec on and the test still passes.

avro_set_error("Snappy block is too small to contain a CRC32 checksum");

@martin-g martin-g Jun 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The indentation is off.

@dxbjavid dxbjavid Jun 22, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch, fixed. the block now uses the same spacing as the rest of the function.

return 1;
}

if (snappy_uncompressed_length((const char*)data, len-4, &outlen) != SNAPPY_OK) {
avro_set_error("Uncompressed length error in snappy");
return 1;
Expand Down
Loading