feat: add max slice alloc size config

codec_array.go

@@ -59,6 +59,12 @@ func (d *arrayDecoder) Decode(ptr unsafe.Pointer, r *Reader) {
 			r.ReportError("decode array", "size exceeded max allocation size")
 			return
 		}
+
+		if max := r.cfg.getMaxSliceAllocSize(); max > 0 && size > max {
+			r.ReportError("decode array", "size is greater than `Config.MaxSliceAllocSize`")
+			return
+		}
+
 		sliceType.UnsafeGrow(ptr, size)
 
 		for i := start; i < size; i++ {

config.go

@@ -8,7 +8,10 @@ import (
 	"github.com/modern-go/reflect2"
 )
 
-const defaultMaxByteSliceSize = 1_048_576 // 1 MiB
+const (
+	defaultMaxByteSliceSize  = 1_048_576 // 1 MiB
+	defaultMaxSliceAllocSize = -1
+)
 
 // DefaultConfig is the default API.
 var DefaultConfig = Config{}.Freeze()
@@ -49,6 +52,10 @@ type Config struct {
 	// MaxByteSliceSize is the maximum size of `bytes` or `string` types the Reader will create, defaulting to 1MiB.
 	// If this size is exceeded, the Reader returns an error. This can be disabled by setting a negative number.
 	MaxByteSliceSize int
+
+	// MaxSliceAllocSize is the maximum size that the decoder will allocate, disabled by default.
+	// If this size is exceeded, the decoder returns an error. This can be disabled by setting a negative number.
+	MaxSliceAllocSize int
 }
 
 // Freeze makes the configuration immutable.
@@ -266,3 +273,11 @@ func (c *frozenConfig) getMaxByteSliceSize() int {
 	}
 	return size
 }
+
+func (c *frozenConfig) getMaxSliceAllocSize() int {
+	size := c.config.MaxSliceAllocSize
+	if size == 0 {
+		return defaultMaxSliceAllocSize
+	}
+	return size
+}

decoder_array_test.go

@@ -91,3 +91,18 @@ func TestDecoder_ArrayMaxAllocationError(t *testing.T) {
 
 	assert.Error(t, err)
 }
+
+func TestDecoder_ArrayExceedMaxSliceAllocationConfig(t *testing.T) {
+	avro.DefaultConfig = avro.Config{MaxSliceAllocSize: 5}.Freeze()
+
+	// 10 (long) gets encoded to 0x14
+	data := []byte{0x14}
+	schema := `{"type":"array", "items": { "type": "boolean" }}`
+	dec, err := avro.NewDecoder(schema, bytes.NewReader(data))
+	require.NoError(t, err)
+
+	var got []bool
+	err = dec.Decode(&got)
+
+	assert.Error(t, err)
+}