---
license: other
library_name: orc
tags:
- security
- vulnerability-research
- huntr
---

# WARNING: SECURITY RESEARCH — PROOF OF CONCEPT ONLY

This repository contains malformed/crafted Apache ORC files that trigger crashes (unbounded allocation, integer overflow) in ORC's C++ reader (`DictionaryLoader.cc` / `ColumnReader.cc` / `StripeStream.cc`). These are **passive data files**, not executable code — they do nothing on their own and only cause a crash/OOM/OOB-read when parsed by `orc::createReader()` / `RowReader::next()`.

**DO NOT** load these files with a production ORC build outside of an isolated, disposable research environment (memory exhaustion and memory-safety risk).

## Findings Summary

| File | Finding | CWE | Confirmation | Location |
|------|---------|-----|---------------|----------|
| `dictionary_wraparound_poc.orc` | Integer wraparound → zero-capacity buffer | CWE-190 | Prior art (EnigmaConsultant), included for reference | `DictionaryLoader.cc:67` |
| `dictionary_unbounded_alloc_poc.orc` | Unbounded allocation (~34GB) | CWE-789 | Fuzz-confirmed (1M+ execs, 6.5h) | `DictionaryLoader.cc:67` |
| `string_vectorbatch_resize_poc.orc` | Unbounded allocation (StringVectorBatch) | CWE-789 | Fuzz-confirmed | `ColumnReader.cc:743` |
| `string_direct_reader_resize_poc.orc` | Unbounded allocation (StringDirectColumnReader) | CWE-789 | Fuzz-confirmed | `ColumnReader.cc:743` |
| `stripestream_offset_overflow_poc.orc` | Integer overflow → OOB read | CWE-190/CWE-125 | Manually-confirmed (protobuf-valid PoC) | `StripeStream.cc:94` |

**Note:** `dictionary_wraparound_poc.orc` reproduces a previously-documented finding by EnigmaConsultant (HuggingFace: [`EnigmaConsultant/orc-dictionary-overflow`](https://huggingface.co/EnigmaConsultant/orc-dictionary-overflow)) and is included here only for completeness/context, **not as a novel claim**. The other four files represent this report's independent contributions.

## Reproduction

```bash
# Build ORC C++ from source (HEAD a6f12fd)
# Compile with ASan+UBSan for crash detection
clang++ -std=c++17 -fsanitize=address,undefined -g -O1 \
    -I/path/to/orc/c++/include -I/path/to/orc/build/c++/include \
    -c fuzzer_harness.cc -o fuzzer_harness.o

clang++ -fsanitize=address,undefined -g -O1 \
    fuzzer_harness.o /path/to/orc/build/c++/src/liborc.a \
    /path/to/orc/build/_deps/protobuf-build/liborc_vendored_protobuf.a \
    /path/to/orc/build/_deps/snappy-build/liborc_vendored_snappy.a \
    /path/to/orc/build/_deps/zstd-build/lib/liborc_vendored_zstd.a \
    /path/to/orc/build/_deps/lz4-build/liborc_vendored_lz4.a \
    /path/to/orc/build/_deps/zlib-build/liborc_vendored_zlib.a \
    -lz -ldl -lpthread -o fuzzer_harness

# Test each PoC
./fuzzer_harness dictionary_unbounded_alloc_poc.orc
```

A minimal fuzzer harness that calls `orc::createReader()` + `RowReader::next()` is sufficient to reproduce all findings.

## Full Report

See `report.md` in this repository for the complete vulnerability report with ASan stack traces, root cause analysis, and code-level detail per finding.

## Credits

- @drogba771 — Discovery, fuzzing, PoC, analysis
- EnigmaConsultant — Prior art for the wraparound scenario (CWE-190)

## Timeline

- 2026-07-19: Fuzzing campaign (6.5h, 3 AFL++ workers, 1M+ execs)
- 2026-07-19: All 4 findings confirmed