| --- |
| license: other |
| library_name: orc |
| tags: |
| - security |
| - vulnerability-research |
| - huntr |
| --- |
| |
| # WARNING: SECURITY RESEARCH — PROOF OF CONCEPT ONLY |
|
|
| This repository contains malformed/crafted Apache ORC files that trigger crashes (unbounded allocation, integer overflow) in ORC's C++ reader (`DictionaryLoader.cc` / `ColumnReader.cc` / `StripeStream.cc`). These are **passive data files**, not executable code — they do nothing on their own and only cause a crash/OOM/OOB-read when parsed by `orc::createReader()` / `RowReader::next()`. |
|
|
| **DO NOT** load these files with a production ORC build outside of an isolated, disposable research environment (memory exhaustion and memory-safety risk). |
|
|
| ## Findings Summary |
|
|
| | File | Finding | CWE | Confirmation | Location | |
| |------|---------|-----|---------------|----------| |
| | `dictionary_wraparound_poc.orc` | Integer wraparound → zero-capacity buffer | CWE-190 | Prior art (EnigmaConsultant), included for reference | `DictionaryLoader.cc:67` | |
| | `dictionary_unbounded_alloc_poc.orc` | Unbounded allocation (~34GB) | CWE-789 | Fuzz-confirmed (1M+ execs, 6.5h) | `DictionaryLoader.cc:67` | |
| | `string_vectorbatch_resize_poc.orc` | Unbounded allocation (StringVectorBatch) | CWE-789 | Fuzz-confirmed | `ColumnReader.cc:743` | |
| | `string_direct_reader_resize_poc.orc` | Unbounded allocation (StringDirectColumnReader) | CWE-789 | Fuzz-confirmed | `ColumnReader.cc:743` | |
| | `stripestream_offset_overflow_poc.orc` | Integer overflow → OOB read | CWE-190/CWE-125 | Manually-confirmed (protobuf-valid PoC) | `StripeStream.cc:94` | |
|
|
| **Note:** `dictionary_wraparound_poc.orc` reproduces a previously-documented finding by EnigmaConsultant (HuggingFace: [`EnigmaConsultant/orc-dictionary-overflow`](https://huggingface.co/EnigmaConsultant/orc-dictionary-overflow)) and is included here only for completeness/context, **not as a novel claim**. The other four files represent this report's independent contributions. |
|
|
| ## Reproduction |
|
|
| ```bash |
| # Build ORC C++ from source (HEAD a6f12fd) |
| # Compile with ASan+UBSan for crash detection |
| clang++ -std=c++17 -fsanitize=address,undefined -g -O1 \ |
| -I/path/to/orc/c++/include -I/path/to/orc/build/c++/include \ |
| -c fuzzer_harness.cc -o fuzzer_harness.o |
| |
| clang++ -fsanitize=address,undefined -g -O1 \ |
| fuzzer_harness.o /path/to/orc/build/c++/src/liborc.a \ |
| /path/to/orc/build/_deps/protobuf-build/liborc_vendored_protobuf.a \ |
| /path/to/orc/build/_deps/snappy-build/liborc_vendored_snappy.a \ |
| /path/to/orc/build/_deps/zstd-build/lib/liborc_vendored_zstd.a \ |
| /path/to/orc/build/_deps/lz4-build/liborc_vendored_lz4.a \ |
| /path/to/orc/build/_deps/zlib-build/liborc_vendored_zlib.a \ |
| -lz -ldl -lpthread -o fuzzer_harness |
| |
| # Test each PoC |
| ./fuzzer_harness dictionary_unbounded_alloc_poc.orc |
| ``` |
|
|
| A minimal fuzzer harness that calls `orc::createReader()` + `RowReader::next()` is sufficient to reproduce all findings. |
|
|
| ## Full Report |
|
|
| See `report.md` in this repository for the complete vulnerability report with ASan stack traces, root cause analysis, and code-level detail per finding. |
|
|
| ## Credits |
|
|
| - @drogba771 — Discovery, fuzzing, PoC, analysis |
| - EnigmaConsultant — Prior art for the wraparound scenario (CWE-190) |
|
|
| ## Timeline |
|
|
| - 2026-07-19: Fuzzing campaign (6.5h, 3 AFL++ workers, 1M+ execs) |
| - 2026-07-19: All 4 findings confirmed |
|
|
