| --- |
| library_name: avro |
| tags: |
| - security |
| - model-format-vulnerability |
| - avro |
| - denial-of-service |
| --- |
| |
| # Apache Avro Python deflate decompression bomb PoC |
|
|
| This repository contains a minimal proof of concept for a resource-exhaustion issue in Apache Avro's official Python reader. |
|
|
| Affected: |
|
|
| - `avro==1.12.1` from PyPI |
| - Apache Avro `main` at commit `840dc8139f4b3d1bfa8e8c8f1ac3be949b440634` |
|
|
| Root cause: |
|
|
| - `avro.datafile.DataFileReader.__next__()` calls `_read_block_header()`. |
| - `_read_block_header()` calls `codec.decompress(self.raw_decoder)`. |
| - `avro.codecs.DeflateCodec.decompress()` reads the compressed Avro block and calls `zlib.decompress(data, -15)` without any maximum decompressed-size or expansion-ratio limit. |
|
|
| The included `avro-deflate-128m.avro` is a valid deflate-coded Avro object container file. It is 130,634 bytes on disk and expands to a 134,217,728-byte `bytes` field during normal `DataFileReader` iteration. |
|
|
| ## Reproduction |
|
|
| ```bash |
| python3 -m venv .venv |
| .venv/bin/pip install avro==1.12.1 |
| .venv/bin/python verify_avro_deflate_bomb_poc.py \ |
| avro-deflate-control.avro \ |
| avro-deflate-128m.avro |
| ``` |
|
|
| Expected result on the test host: |
|
|
| ```text |
| control file_size=181 -> loaded, payload_len=1024, maxrss_after_kb around 18,000 |
| bomb file_size=130634 -> loaded, payload_len=134217728, maxrss_after_kb around 280,000 |
| ``` |
|
|
| With a 160 MiB address-space cap, the control loads while the bomb fails in the Avro block decompression path: |
|
|
| ```bash |
| .venv/bin/python verify_avro_deflate_bomb_poc.py --limit-mb 160 \ |
| avro-deflate-control.avro \ |
| avro-deflate-128m.avro |
| ``` |
|
|
| Observed exception: |
|
|
| ```text |
| MemoryError: Unable to allocate output buffer. |
| File ".../avro/datafile.py", line 404, in __next__ |
| File ".../avro/datafile.py", line 386, in _read_block_header |
| File ".../avro/codecs.py", line 126, in decompress |
| uncompressed = zlib.decompress(data, -15) |
| ``` |
|
|
| ## Files |
|
|
| - `avro-deflate-128m.avro` - 130,634-byte trigger file, SHA256 `a050bf7715a45d46f0abe327b94557e7d5f209cbdb549292de9e3fe5104df8f0` |
| - `avro-deflate-control.avro` - 181-byte control file, SHA256 `fd1d3d5cc0722727329d536ee8ab20e4fc3da2629c8921ffde850e96056d7ae9` |
| - `make_avro_deflate_bomb_poc.py` - generator |
| - `verify_avro_deflate_bomb_poc.py` - verifier |
|
|
| ## Notes |
|
|
| Apache Avro Java recently added decompression-size limits for the same class of codec bomb in AVRO-4247. This PoC demonstrates that the official Python Avro reader still lacks an equivalent limit in the latest PyPI release and in current Apache Avro main. |
|
|
