This repository contains malformed/crafted Apache ORC files that trigger crashes (unbounded allocation, integer overflow) in ORC's C++ reader (DictionaryLoader.cc / ColumnReader.cc / StripeStream.cc). These are passive data files, not executable code — they do nothing on their own and only cause a crash/OOM/OOB-read when parsed by orc::createReader() / RowReader::next().
Note: dictionary_wraparound_poc.orc reproduces a previously-documented finding by EnigmaConsultant (HuggingFace:
EnigmaConsultant/orc-dictionary-overflow) and is included here only for completeness/context,
not as a novel claim. The other four files represent this report's independent contributions.
1# Build ORC C++ from source (HEAD a6f12fd)
2# Compile with ASan+UBSan for crash detection
3clang++ -std=c++17 -fsanitize=address,undefined -g -O1 \
4 -I/path/to/orc/c++/include -I/path/to/orc/build/c++/include \
5 -c fuzzer_harness.cc -o fuzzer_harness.o
6
7clang++ -fsanitize=address,undefined -g -O1 \
8 fuzzer_harness.o /path/to/orc/build/c++/src/liborc.a \
9 /path/to/orc/build/_deps/protobuf-build/liborc_vendored_protobuf.a \
10 /path/to/orc/build/_deps/snappy-build/liborc_vendored_snappy.a \
11 /path/to/orc/build/_deps/zstd-build/lib/liborc_vendored_zstd.a \
12 /path/to/orc/build/_deps/lz4-build/liborc_vendored_lz4.a \
13 /path/to/orc/build/_deps/zlib-build/liborc_vendored_zlib.a \
14 -lz -ldl -lpthread -o fuzzer_harness
15
16# Test each PoC
17./fuzzer_harness dictionary_unbounded_alloc_poc.orc
