Downloads · 30 days
0
orc-rlev2-patched-base-oob-poc
ChristianTeroerde/orc-rlev2-patched-base-oob-poc
orc-rlev2-patched-base-oob-poc is a machine learning model from ChristianTeroerde. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as apache-2.0.
Responsible-disclosure proof-of-concept submitted via huntr.
Access
Public
Updated Jun 20, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 60%
At a glance
- License
- apache-2.0
- Access
- Public
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026
- SHA
- 70f6d3e2
Model card
From the Hugging Face model README
PoC: Out-of-bounds heap read in Apache ORC C++ (RLEv2 PATCHED_BASE)
Responsible-disclosure proof-of-concept submitted via huntr.
evil.orc (115 bytes) is a crafted Apache ORC file: one LONG column whose RLEv2 PATCHED_BASE data stream
sets pl=31 with every patch entry gap=255 / patch=0, driving RleDecoderV2::adjustGapAndPatch to walk
unpackedPatch_[idx] past the 248-byte buffer end → out-of-bounds heap read (CWE-125) in the stock reader
(createReader → IntegerColumnReader → RleDecoderV2::nextPatched).
Benign marker only (read past a heap buffer; no code execution, no payload). For maintainers: bound the gap-walk
against unpackedPatch_.size(). Repro: build apache/orc with -fsanitize=address -DBUILD_TOOLS=ON, run
orc-contents evil.orc.
- License
- apache-2.0
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026