Sync two upstream decoder limit fixes into the vendored azure-uamqp-c

Abierto
  • ¿Algo no está bien?
#7,342 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@j7nw4r ya está trabajando en esto.

Desde el 17/8/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Summary

The vendored copy of azure-uamqp-c does not carry two decoder fixes that upstream merged on 2026-05-19. Both fixes bound the resources that the AMQP value decoder gives to one input. Cherry-pick both into sdk/core/azure-core-amqp/src/impl/uamqp/vendor/azure-uamqp-c.

Motivation

The AMQP value decoder reads data from the network, so a bound on its resource use protects every caller of the uAMQP transport.

Upstream #479 extends the existing 100 MB allocation guard to the vbin32, str32, and sym32 decode paths. The vendored src/amqpvalue.c defines MAX_AMQPVALUE_MALLOC_SIZE_BYTES at line 17 and reads it only at line 6456, which is the list32 path.

Upstream #478 caps decoder nesting at 128 levels, so a deeply nested described value, list, map, or array cannot drive unbounded recursion. The vendored copy defines no MAX_DECODER_DEPTH.

The C++ SDK ships the uAMQP transport today. A move to the Rust transport does not remove this code from a consumer that still selects uAMQP.

Proposal

  • Cherry-pick upstream #479 into the vendored src/amqpvalue.c, with the three unit tests that it adds.
  • Cherry-pick upstream #478 into the vendored decoder, with the unit tests that it adds.
  • Keep the rest of upstream master out of this change. Upstream also migrated its dependencies and reworked its CI, and neither one touches this repository.
  • Upstream version.txt reads 1.2.12, which matches the vendored copy, so no tagged release carries these fixes. A maintainer must decide whether this repository takes a cherry-pick from upstream master.

Validation

PR #7324 built the vendored library on every cpp - core - ci matrix leg with DISABLE_RUST_IN_BUILD on. That run reported no compiler warning and no error for the vendored tree, so it is the baseline for this change.

Lenguaje dominante
C++
Estrellas
206
Forks
178
Merge medio
2 d 15 h
PR fusionados (30 d)
33

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/azure-sdk-for-cpp

Todos los issues de Azure/azure-sdk-for-cpp

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.