avro-variant-cwe400-poc

apache/avro — CWE-400 CPU DoS via Unbounded Varint

Target

Root Cause

read_long() decodes varints with no iteration cap. The Avro spec limits longs to 64-bit (max 10 varint bytes), but the library accepts any length. Python big-integer bit-shifts grow proportionally with the integer's bit-width, making the total cost O(N²) in varint bytes consumed.

while (b & 0x80) != 0:          # NO iteration limit
    b = ord(self.read(1))
    n |= (b & 0x7F) << shift    # shift grows → n grows → O(N) per step
    shift += 7

Trigger Path

Crafted .avro file → DataFileReader.__init__() → read_header() → read_meta() → read_long() at metadata map block_count → O(N²) CPU burn before any error.

Reproduction

# Setup (from apache/avro repo root)
python -m venv venv && source venv/bin/activate
pip install -e lang/py

# Run PoC
python poc_avro_cwe400_varint.py

Expected output:

Scaling test (confirms O(N^2) CPU growth):
      1,000 varint bytes -> 0.0016s
     10,000 varint bytes -> 0.0113s
    100,000 varint bytes -> 0.5137s

Demo: 200,000-byte varint in file header (200,005 bytes total)
CPU time before error: 2.03s
Error: InvalidAvroBinaryEncoding: Read 0 bytes, expected 1 bytes

Amplification

Files

Fix

Add MAX_VARINT_BYTES = 10 and a counter in read_long(). Reject any varint exceeding 10 bytes — the spec guarantees valid input will never need more.