# PoC: Uncontrolled Recursion in Avro Schema Parsing → Process Crash (SIGSEGV)

**Affected:** `avro` (Apache Avro Python package) 1.12.1
**Vulnerability class:** CWE-674 (Uncontrolled Recursion)

## What this repo contains

`malicious_schema.avsc` — a valid-syntax Avro schema file, 8,756 bytes,
consisting of 350 nested `"array"` type wrappers around a base `"long"`
type. Every individual level is syntactically valid Avro; only the
nesting depth is abusive.

## How to reproduce

```bash
pip install avro
python3 reproduce.py
```

On an affected system, this crashes the Python process with SIGSEGV
(exit code 139 / "Segmentation fault") — not a caught Python
exception — when the schema is parsed on a thread with a reduced
stack size (256KB, the standard default greenlet stack size used by
`gevent`/`eventlet`, common in async Kafka/AMQP consumer deployments
written in Python).

On a default (full-size) thread stack, the same file only produces a
catchable `RecursionError` — the crash specifically requires the
reduced-stack execution context, which is realistic but not
universal. See the full report for details.

## Why this matters

Any Python service that (a) accepts externally-supplied Avro schemas
(e.g. a Kafka consumer that reads schema definitions from message
metadata or a schema registry) and (b) runs on a
`gevent`/`eventlet`-style worker, can have its entire worker process
crashed by a single ~9KB malicious schema — not just the one message
being processed.

Full write-up, environment details, threshold measurements, and
suggested remediation are in the accompanying disclosure report.