Skip to content

AVRO-4270: [C] Fix wrong schema accessor in avro_generic_map_class#3823

Open
KyleKim107 wants to merge 1 commit into
apache:mainfrom
KyleKim107:fix/generic-map-wrong-schema-accessor
Open

AVRO-4270: [C] Fix wrong schema accessor in avro_generic_map_class#3823
KyleKim107 wants to merge 1 commit into
apache:mainfrom
KyleKim107:fix/generic-map-wrong-schema-accessor

Conversation

@KyleKim107

Copy link
Copy Markdown

What is the purpose of the change

avro_generic_map_class() in lang/c/src/generic.c incorrectly calls
avro_schema_array_items(schema) instead of avro_schema_map_values(schema).
This is a copy-paste bug from the array class implementation.

The wrong accessor reinterprets a MAP schema pointer as an ARRAY schema type.
Under UndefinedBehaviorSanitizer with -fno-sanitize-recover, this triggers a
fatal diagnostic when processing MAP schemas. Without sanitizers the code
silently returns the correct value today because avro_array_schema_t and
avro_map_schema_t share the same memory layout, but this is fragile and will
break if the struct layouts diverge.

This pull request fixes AVRO-4270.

Verifying this change

This change can be verified as follows:

  • Built the C library with ASan + UBSan:
    -fsanitize=address,undefined -fno-sanitize-recover=undefined -g -O1
  • Ran a custom value_reader_fuzzer targeting avro_value_read() with a PoC
    input that selects a {"type":"map","values":"string"} schema
  • Before fix: UBSan aborts in the map value initialization path
  • After fix: no UBSan diagnostic; input is processed normally

Discovered by FuzzingBrain @o2lab.

Documentation

  • Does this pull request introduce a new feature? (yes / no)
    no
  • If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented)
    not applicable

@github-actions github-actions Bot added the C label Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants