metadata
license: apache-2.0
tags:
- security
- coordinated-disclosure
Avro enum out-of-range PoC (coordinated disclosure)
Proof-of-concept artifact for a coordinated vulnerability disclosure against the
Apache Avro C library (apache/avro, lang/c, release-1.12.0).
enum_repro.avro is a 117-byte Avro Object Container File. Its declared schema
is an enum with symbols ["A","B"] (valid indices 0 and 1); the single encoded
value uses enum index 100, which is out of range. Loading and rendering this file
with the reference avrocat tool triggers an uninitialized-pointer read (crash)
in avro_schema_enum_get.
This artifact is provided under coordinated disclosure and is gated; access is restricted to the disclosure platform's review bot.