Skip to content

fix(go): added fieldcount boundation checks#3620

Open
ayush00git wants to merge 1 commit intoapache:mainfrom
ayush00git:fix/fieldcount_checks
Open

fix(go): added fieldcount boundation checks#3620
ayush00git wants to merge 1 commit intoapache:mainfrom
ayush00git:fix/fieldcount_checks

Conversation

@ayush00git
Copy link
Copy Markdown
Contributor

@ayush00git ayush00git commented Apr 25, 2026

Why?

Malicious payloads could specify a massive fieldCount, causing the runtime to attempt an unbounded memory allocation.
Deeply nested schema definitions (like a LIST of LIST...) could trigger unbounded recursion, exceeding the goroutine stack limit and crashing the process.

What does this PR do?

Added a hard limit of 10,000 fields and a buffer-remaining check in decodeTypeDef to prevent massive slice allocations.
Added a depth parameter to readFieldType and readFieldTypeWithFlags, capping nested schema definitions at a maximum depth of 64.

Related issues

#3619

AI Contribution Checklist

  • Substantial AI assistance was used in this PR: yes / no
  • If yes, I included a completed AI Contribution Checklist in this PR description and the required AI Usage Disclosure.
  • If yes, my PR description includes the required ai_review summary and screenshot evidence of the final clean AI review results from both fresh reviewers on the current PR diff or current HEAD after the latest code changes.

Does this PR introduce any user-facing change?

  • Does this PR introduce any public API change?
  • Does this PR introduce any binary protocol compatibility change?

Benchmark

@ayush00git ayush00git requested a review from chaokunyang as a code owner April 25, 2026 21:27
@ayush00git
Copy link
Copy Markdown
Contributor Author

@chaokunyang i'm planning to create these bounds configurable, moving them to the Config.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant