mfv-avro-enum-oob

Avro C Library – ENUM OOB PoC

CVE: TBD (submitted to Huntr)
Target: Apache Avro C library (lang/c)
Vulnerability: Unvalidated ENUM index → uninitialized pointer read → SEGV / info-leak

Files

• avro_poc.py — generates malicious Avro binary datum with out-of-range enum index
• avro_enum_oob.bin — pre-built payload (enum index=0x7fffffff, 5 bytes)

Schema

{"type":"enum","name":"E","symbols":["A","B"]}

Root Cause

lang/c/src/value-read.c reads enum index via read_long() and passes it to avro_value_set_enum() without bounds-checking against the symbol count. avro_schema_enum_get() (schema.c:534) then performs st_lookup() which fails silently, returning an uninitialized stack union reinterpreted as char*. The JSON serializer dereferences this pointer → SEGV or OOB read.