moon-o/orc-liborc-timestamp-printer-stack-oob-poc

Apache ORC (liborc) stack-buffer-overflow PoC (timestamp printer)

huntr Model File Vulnerability PoC. Loading poc_orc_A_timestamp_printer_stack_oob.orc with liborc's shipped orc-contents (built with -fsanitize=address) triggers a stack-buffer-overflow READ at c++/src/ColumnPrinter.cc:205 (orc::writeString, via TimestampColumnPrinter::printRow): a file-controlled out-of-range timestamp year makes strftime return 0, leaving timeBuffer[20] non-NUL-terminated, so strlen reads past it. Reproduce:

orc-contents poc_orc_A_timestamp_printer_stack_oob.orc

For security research / responsible disclosure only.