AIKIDO-2026-702909

TL;DR

The Avro Object Container File reader in arrow-avro reads block sizes, item counts, and variable-length integers directly from input without bounding them. A crafted Avro file can declare a huge block size that triggers an oversized allocation and aborts the process, an item count that drives the array or map decode loop into an effectively endless loop, or an overlong varint that overflows the shift in VLQDecoder::long and panics. These conditions are reachable from untrusted Avro bytes through the public ReaderBuilder::build path and result in denial of service. The fix bounds block sizes and item counts against the remaining input and rejects overlong varints with a parse error.