Bump contrib/azure to fix Base64Decode global-buffer-overflow and undefined shift

Browse Source

The vendored Azure SDK Base64Decode mishandles invalid Base64 input in two ways,
both reachable in ClickHouse from azureBlobStorage() with a malformed account_key
(StorageSharedKeyCredential -> SharedKeyPolicy::GetSignature ->
Convert::Base64Decode(GetAccountKey())). It surfaced under the stress-test query
fuzzer and recurs across unrelated PRs; it is a latent SDK bug, not PR-specific.

1. Out-of-bounds read. Input bytes were read through 'const char*' and used to
   index Base64DecodeArray (int8_t[256]). On platforms where char is signed, any
   byte >= 0x80 sign-extended to a negative index and read out of bounds of the
   global table (AddressSanitizer: global-buffer-overflow, READ of size 1).

2. Undefined left shift. After an invalid byte mapped to the table's -1 sentinel,
   the decoder shifted it (i0 <<= 18, etc.) before checking for the sentinel.
   Left-shifting a negative value is undefined behavior prior to C++20; builds
   with -fsanitize=undefined -fno-sanitize-recover=all abort on it.

Bump contrib/azure to the fix commit, which reads each input byte as unsigned char
before indexing and rejects the -1 sentinel before any shift, so malformed input
throws cleanly on every code path. A strengthened Base64.InvalidDecode test
exercises an invalid byte in every position of both decode paths. The same fix is
submitted to the vendored fork (ClickHouse/azure-sdk-for-cpp#36) and to Microsoft
upstream (Azure/azure-sdk-for-cpp#7200).

...

This commit is contained in:

Groene AI

2026-06-29 15:40:15 +00:00

parent 6871157877

commit c5e930123f

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

contrib/azure

Vendored

+1 -1

Submodule contrib/azure updated: e1c250fe5d...20f8b46b87