-
Notifications
You must be signed in to change notification settings - Fork 0
3732: AVRO-4246: [c] Fix memory leak on failed decoding #38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| The AI agents should never link to any issue or a pull request | ||
| in any GitHub repository in the code reviews! | ||
|
|
||
| The AI agents should not review AI agents' config files like CLAUDE.md or AGENTS.md! | ||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| The AI agents should never link to any issue or a pull request | ||
| in any GitHub repository in the code reviews! | ||
|
|
||
| The AI agents should not review AI agents' config files like CLAUDE.md or AGENTS.md! | ||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| The AI agents should never link to any issue or a pull request | ||
| in any GitHub repository in the code reviews! | ||
|
|
||
| The AI agents should not review AI agents' config files like CLAUDE.md or AGENTS.md! | ||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| The AI agents should never link to any issue or a pull request | ||
| in any GitHub repository in the code reviews! | ||
|
|
||
| The AI agents should not review AI agents' config files like CLAUDE.md or AGENTS.md! | ||
|
|
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -96,6 +96,8 @@ typedef struct avro_encoding_t avro_encoding_t; | |||||||||
| { int rval = avro_write( writer, buf, len ); if(rval) return rval; } | ||||||||||
| #define AVRO_READ(reader, buf, len) \ | ||||||||||
| { int rval = avro_read( reader, buf, len ); if(rval) return rval; } | ||||||||||
| #define AVRO_READ_OR_FREE(reader, buf, len) \ | ||||||||||
| { int rval = avro_read( reader, buf, len ); if(rval) { avro_free(buf, 0); buf = NULL; return rval; } } | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Wrong size passed to
|
||||||||||
| #define AVRO_READ_OR_FREE(reader, buf, len) \ | |
| { int rval = avro_read( reader, buf, len ); if(rval) { avro_free(buf, 0); buf = NULL; return rval; } } | |
| `#define` AVRO_READ_OR_FREE(reader, buf, len) \ | |
| { int rval = avro_read( reader, buf, len ); if(rval) { avro_free(buf, (size_t)(len) + 1); buf = NULL; return rval; } } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@lang/c/src/encoding.h` around lines 99 - 100, The macro AVRO_READ_OR_FREE
currently calls avro_free(buf, 0) which violates the allocator contract because
callers allocate len + 1 bytes; change the macro to pass the correct old-size
(len + 1) to avro_free so the free matches avro_malloc's allocation size (i.e.,
replace the avro_free(buf, 0) call in AVRO_READ_OR_FREE with avro_free(buf, len
+ 1)); this ensures avro_free and AVRO_READ_OR_FREE honor the allocator/osize
requirement used by avro_malloc and custom allocators.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AVRO_READ_OR_FREE calls avro_free(buf, 0), but the allocator API expects the osize passed to avro_free to match the allocation size; several tests/custom allocators validate this and will abort on mismatch. Since the bytes/string paths allocate an extra NUL byte (len+1), freeing with size 0 can break exactly the failed-read path this macro is meant to clean up.
Severity: high
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -136,8 +136,8 @@ static int read_bytes(avro_reader_t reader, char **bytes, int64_t * len) | |
| avro_set_error("Cannot allocate buffer for bytes value"); | ||
| return ENOMEM; | ||
| } | ||
| AVRO_READ(reader, *bytes, *len); | ||
| (*bytes)[*len] = '\0'; | ||
| AVRO_READ_OR_FREE(reader, *bytes, *len); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
| return 0; | ||
| } | ||
|
|
||
|
|
@@ -194,7 +194,7 @@ static int read_string(avro_reader_t reader, char **s, int64_t *len) | |
| return ENOMEM; | ||
| } | ||
| (*s)[str_len] = '\0'; | ||
| AVRO_READ(reader, *s, str_len); | ||
| AVRO_READ_OR_FREE(reader, *s, str_len); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
| return 0; | ||
| } | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,223 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to you under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or | ||
| * implied. See the License for the specific language governing | ||
| * permissions and limitations under the License. | ||
| */ | ||
|
|
||
| #include <stdio.h> | ||
| #include <stdlib.h> | ||
| #include <string.h> | ||
| #include <stdint.h> | ||
| #include <avro.h> | ||
|
|
||
| #define STRING_SCHEMA_LITERAL "\"string\"" | ||
| #define INT_SCHEMA_LITERAL "\"int\"" | ||
|
|
||
| typedef struct | ||
| { | ||
| char data[256]; | ||
| size_t size; | ||
| } encoded_buf_t; | ||
|
|
||
| static int encode_int( | ||
| avro_value_iface_t *iface, | ||
| int32_t number, | ||
| encoded_buf_t *out_buf) | ||
| { | ||
| int rc; | ||
| avro_value_t value; | ||
| avro_writer_t writer = NULL; | ||
|
|
||
| memset(out_buf, 0, sizeof(*out_buf)); | ||
|
|
||
| rc = avro_generic_value_new(iface, &value); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "encode_int: avro_generic_value_new failed: %s\n", | ||
| avro_strerror()); | ||
| return rc; | ||
| } | ||
|
|
||
| rc = avro_value_set_int(&value, number); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "encode_int: avro_value_set_int failed: %s\n", | ||
| avro_strerror()); | ||
| avro_value_decref(&value); | ||
| return rc; | ||
| } | ||
|
|
||
| writer = avro_writer_memory(out_buf->data, sizeof(out_buf->data)); | ||
| if (writer == NULL) | ||
| { | ||
| fprintf(stderr, "encode_int: avro_writer_memory failed\n"); | ||
| avro_value_decref(&value); | ||
| return -1; | ||
| } | ||
|
|
||
| rc = avro_value_write(writer, &value); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "encode_int: avro_value_write failed: %s\n", | ||
| avro_strerror()); | ||
| avro_writer_free(writer); | ||
| avro_value_decref(&value); | ||
| return rc; | ||
| } | ||
|
|
||
| out_buf->size = avro_writer_tell(writer); | ||
|
|
||
| avro_writer_free(writer); | ||
| avro_value_decref(&value); | ||
| return 0; | ||
| } | ||
|
|
||
| static int decode_as_string( | ||
| avro_value_iface_t *string_iface, | ||
| const void *buf, | ||
| size_t buf_size, | ||
| const char *label) | ||
| { | ||
| int rc; | ||
| avro_reader_t reader = NULL; | ||
| avro_value_t decoded; | ||
| const char *text = NULL; | ||
| size_t text_size = 0; | ||
|
|
||
| rc = avro_generic_value_new(string_iface, &decoded); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "%s: avro_generic_value_new failed: %s\n", | ||
| label, avro_strerror()); | ||
| return rc; | ||
| } | ||
|
|
||
| reader = avro_reader_memory((const char *)buf, buf_size); | ||
| if (reader == NULL) | ||
| { | ||
| fprintf(stderr, "%s: avro_reader_memory failed\n", label); | ||
| avro_value_decref(&decoded); | ||
| return -1; | ||
| } | ||
|
|
||
| rc = avro_value_read(reader, &decoded); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "%s: avro_value_read failed as expected? rc=%d err=%s\n", | ||
| label, rc, avro_strerror()); | ||
| avro_reader_free(reader); | ||
| avro_value_decref(&decoded); | ||
| return rc; | ||
| } | ||
|
|
||
| rc = avro_value_get_string(&decoded, &text, &text_size); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "%s: avro_value_get_string failed: %s\n", | ||
| label, avro_strerror()); | ||
| avro_reader_free(reader); | ||
| avro_value_decref(&decoded); | ||
| return rc; | ||
| } | ||
|
|
||
| printf("%s: decoded successfully: \"%s\" (%zu bytes)\n", | ||
| label, text, text_size); | ||
|
|
||
| avro_reader_free(reader); | ||
| avro_value_decref(&decoded); | ||
| return 0; | ||
| } | ||
|
|
||
| int main(void) | ||
| { | ||
| int rc; | ||
| int ret = EXIT_SUCCESS; | ||
|
|
||
| avro_schema_t string_schema = NULL; | ||
| avro_schema_t int_schema = NULL; | ||
|
|
||
| avro_value_iface_t *string_iface = NULL; | ||
| avro_value_iface_t *int_iface = NULL; | ||
|
|
||
| encoded_buf_t encoded_string; | ||
| encoded_buf_t encoded_int; | ||
|
|
||
| rc = avro_schema_from_json_literal(STRING_SCHEMA_LITERAL, &string_schema); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "Failed to parse string schema: %s\n", avro_strerror()); | ||
| return EXIT_FAILURE; | ||
| } | ||
|
|
||
| rc = avro_schema_from_json_literal(INT_SCHEMA_LITERAL, &int_schema); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "Failed to parse int schema: %s\n", avro_strerror()); | ||
| avro_schema_decref(string_schema); | ||
| return EXIT_FAILURE; | ||
| } | ||
|
|
||
| string_iface = avro_generic_class_from_schema(string_schema); | ||
| if (string_iface == NULL) | ||
| { | ||
| fprintf(stderr, "Failed to create string iface\n"); | ||
| avro_schema_decref(int_schema); | ||
| avro_schema_decref(string_schema); | ||
| return EXIT_FAILURE; | ||
| } | ||
|
|
||
| int_iface = avro_generic_class_from_schema(int_schema); | ||
| if (int_iface == NULL) | ||
| { | ||
| fprintf(stderr, "Failed to create int iface\n"); | ||
| avro_value_iface_decref(string_iface); | ||
| avro_schema_decref(int_schema); | ||
| avro_schema_decref(string_schema); | ||
| return EXIT_FAILURE; | ||
| } | ||
|
|
||
| rc = encode_int(int_iface, 12345, &encoded_int); | ||
| if (rc != 0) | ||
| { | ||
| fprintf(stderr, "Encoding int failed\n"); | ||
| avro_value_iface_decref(int_iface); | ||
| avro_value_iface_decref(string_iface); | ||
| avro_schema_decref(int_schema); | ||
| avro_schema_decref(string_schema); | ||
| return EXIT_FAILURE; | ||
| } | ||
|
|
||
| printf("Encoded int size: %zu bytes\n", encoded_int.size); | ||
|
|
||
| rc = decode_as_string(string_iface, | ||
| encoded_int.data, | ||
| encoded_int.size, | ||
| "int payload as string"); | ||
| if (rc == 0) | ||
| { | ||
| fprintf(stderr, "Unexpected success decoding int payload as string\n"); | ||
| ret = EXIT_FAILURE; | ||
| } | ||
| else | ||
| { | ||
| printf("int payload as string: failed cleanly, as expected\n"); | ||
| } | ||
|
|
||
| avro_value_iface_decref(int_iface); | ||
| avro_value_iface_decref(string_iface); | ||
| avro_schema_decref(int_schema); | ||
| avro_schema_decref(string_schema); | ||
|
|
||
| return ret; | ||
| } |


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
AVRO_READ_OR_FREEmacro uses a hardcoded size of0when callingavro_free. In the Avro C library,avro_freeexpects the actual size of the allocated block. While the default allocator might ignore this value, custom allocators (e.g., pool allocators) often rely on it to correctly manage memory. It is recommended to pass the allocation size as an additional argument to the macro to ensure compatibility with all allocator implementations.