Skip to content

upb: reject aligned MiniTable size overflow#26858

Open
heap-fixer wants to merge 3 commits intoprotocolbuffers:mainfrom
heap-fixer:fix/minitable-align-overflow-clean-20260413
Open

upb: reject aligned MiniTable size overflow#26858
heap-fixer wants to merge 3 commits intoprotocolbuffers:mainfrom
heap-fixer:fix/minitable-align-overflow-clean-20260413

Conversation

@heap-fixer
Copy link
Copy Markdown

This patch fixes a MiniTable size alignment overflow in upb/mini_descriptor/decode.c.

Previously, MiniTable construction checked the unaligned message layout size against UINT16_MAX, stored it in the 16-bit upb_MiniTable::size field, and only then aligned it up to kUpb_Message_Align. For sizes near UINT16_MAX, that alignment step could produce 65536, which truncated to 0 when written back to the 16-bit size field.

That could leave a MiniTable with:

  • size == 0
  • non-zero field offsets

and later cause _upb_Message_New() / upb_Message_New() to allocate a zero-sized arena object for a non-empty message layout.

This patch fixes the issue by:

  • computing the aligned size in size_t
  • checking the aligned result against UINT16_MAX
  • rejecting oversized MiniTables before truncation
  • only storing the value into upb_MiniTable::size after validation

It also adds a regression test covering the alignment-overflow boundary, so MiniTable construction now fails instead of producing a wrapped zero-sized layout.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant