You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello! I've been using Golang's fuzzer to test how ParseBytes deal with data that doesn't match the schema. I've reproduced an edge case where ParseBytes panics with panic: runtime: allocation size out of range. Here is the code:
package main
import "github.com/hamba/avro/v2"
func main() {
rawSchema := []byte("{\"items\":{\"type\":\"boolean\"},\"type\":\"array\"}")
schema, _ := avro.ParseBytes(rawSchema)
data := []byte("\x02\x00\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\x00")
var container any
avro.Unmarshal(schema, data, &container)
}
This is the line of code that leads to the error. The size is 29787588086545014 while the maxAlloc size is const maxAlloc untyped int = (1 << heapAddrBits) - (1-_64bit)*1 // 281474976710656. Perhaps we should do a check here and return an error if it exceeds the maxAlloc size?
In my opinion ParseBytes should never panic and should instead return an error when dealing with invalid data.
The text was updated successfully, but these errors were encountered:
brianshih1
changed the title
Panic: Allocation size out of range Error
Decode Array - Panic: Allocation size out of range Error
Apr 19, 2024
Hello! I've been using Golang's fuzzer to test how
ParseBytes
deal with data that doesn't match the schema. I've reproduced an edge case whereParseBytes
panics withpanic: runtime: allocation size out of range
. Here is the code:This is the line of code that leads to the error. The
size
is29787588086545014
while themaxAlloc
size isconst maxAlloc untyped int = (1 << heapAddrBits) - (1-_64bit)*1 // 281474976710656
. Perhaps we should do a check here and return an error if it exceeds themaxAlloc
size?In my opinion
ParseBytes
should neverpanic
and should instead return an error when dealing with invalid data.The text was updated successfully, but these errors were encountered: