[AVRO-3226] OutOfMemoryException on invalid input for BinaryDecoder.ReadString on NetStandard 2.1+

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.11.0
• Component/s: csharp
• Assignee: Philip Sanetra
• Reporter: Philip Sanetra
• Created: 07/Oct/21 14:58
• Updated: 20/Oct/21 11:22
• Resolved: 20/Oct/21 11:22

Description

The BinaryDecoder.ReadString() method on NetStandard2.1+ produces an OutOfMemoryException if there is invalid input caused by this code:

 

int length = ReadInt();
Span<byte> buffer = length <= StackallocThreshold ? stackalloc byte[length] :                (bufferArray = ArrayPool<byte>.Shared.Rent(length)).AsSpan(0, length);

 

ArrayPool<byte>.Shared.Rent(length) will cause the exception if ReadInt() returns a big number like int.MaxValue.

Issue Links

• is related to: AVRO-3225 StackOverflowException on invalid input for BinaryDecoder.ReadString on NetStandard 2.1+