ORC-2190: Reject compressed chunk length exceeding block size in ORC C++ reader

Author: dongjoon-hyun

c++/src/Compression.cc

@@ -419,6 +419,9 @@ namespace orc {
     MemoryPool& pool;
     std::unique_ptr<SeekableInputStream> input;
 
+    // the configured compression block size, used to validate chunk lengths
+    size_t blockSize;
+
     // uncompressed output
     DataBuffer<char> outputDataBuffer;
 
@@ -460,6 +463,7 @@ namespace orc {
                                            ReaderMetrics* metrics)
       : pool(pool),
         input(std::move(inStream)),
+        blockSize(bufferSize),
         outputDataBuffer(pool, bufferSize),
         state(DECOMPRESS_HEADER),
         outputBufferStart(nullptr),
@@ -518,6 +522,12 @@ namespace orc {
         state = DECOMPRESS_START;
       }
       remainingLength = header >> 1;
+      if (state == DECOMPRESS_START && remainingLength > blockSize) {
+        std::ostringstream ss;
+        ss << "Buffer size too small. size = " << blockSize << " needed = " << remainingLength
+           << " in " << getName();
+        throw ParseError(ss.str());
+      }
     } else {
       remainingLength = 0;
     }

c++/test/TestDecompression.cc

@@ -574,6 +574,19 @@ namespace orc {
     EXPECT_EQ(16, static_cast<const char*>(ptr)[2]);
   }
 
+  TEST(Zlib, testChunkLengthExceedsBlockSize) {
+    // Craft a compressed chunk header whose chunkLength (100) exceeds the
+    // configured block size (5). header = chunkLength << 1 = 200 = 0xC8.
+    const unsigned char buffer[] = {0xc8, 0x0, 0x0, 0x1, 0x2, 0x3, 0x4, 0x5};
+    std::unique_ptr<SeekableInputStream> result = createDecompressor(
+        CompressionKind_ZLIB,
+        std::make_unique<SeekableArrayInputStream>(buffer, ARRAY_SIZE(buffer), 5), 5,
+        *getDefaultPool(), getDefaultReaderMetrics());
+    const void* ptr;
+    int length;
+    EXPECT_THROW(result->Next(&ptr, &length), ParseError);
+  }
+
   TEST(Zlib, testInflate) {
     const unsigned char buffer[] = {0xe, 0x0, 0x0, 0x63, 0x60, 0x64, 0x62, 0xc0, 0x8d, 0x0};
     std::unique_ptr<SeekableInputStream> result =