)]}'
{
  "commit": "414e4142cdc4d43c4eb47f9e4d8b811eeab9d9dc",
  "tree": "bc9579479b2a479f7db8a89719f459c975dc1184",
  "parents": [
    "95a1e90ce0a1bfbef35ad5ff1024459d85a66199"
  ],
  "author": {
    "name": "Joshua Haberman",
    "email": "haberman@google.com",
    "time": "Fri Jul 24 16:51:25 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Fri Jul 24 16:53:12 2026 -0700"
  },
  "message": "Sync sub-objects in PyUpb_Message_MergeFromString even when decode fails.\n\nIn \u0027PyUpb_Message_MergeFromString\u0027, \u0027upb_Decode\u0027 may partially mutate or populate sub-messages on the parent message before failing with a decode error status. Skipping \u0027PyUpb_Message_SyncSubobjs\u0027 when \u0027status !\u003d kUpb_DecodeStatus_Ok\u0027 leaves stub sub-object wrappers unsynced in \u0027unset_subobj_map\u0027, causing duplicate keys in \u0027ObjCache\u0027 on subsequent access and leading to heap-use-after-free.\n\nMove \u0027PyUpb_Message_SyncSubobjs(self)\u0027 before the decode status check in \u0027PyUpb_Message_MergeFromString\u0027 so any sub-message wrappers modified during decoding are synced properly.\n\nAdd \u0027testMergeFromStringDecodeErrorSync\u0027 to \u0027third_party/py/google/protobuf/internal/message_test.py\u0027 to verify that stub sub-objects remain synced and intact after a failed \u0027MergeFromString\u0027.\n\nPiperOrigin-RevId: 953615725\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2739de43b90cdf8abdb0910b3c0a839b4ec0be6c",
      "old_mode": 33261,
      "old_path": "python/google/protobuf/internal/message_test.py",
      "new_id": "9e9aca8c0492cb3db4a68ec88a795500dbdf9174",
      "new_mode": 33261,
      "new_path": "python/google/protobuf/internal/message_test.py"
    },
    {
      "type": "modify",
      "old_id": "e559c08ebb4247402223d7ca890b251f1a1519f1",
      "old_mode": 33188,
      "old_path": "python/message.c",
      "new_id": "a9b6a8c72172c663cdd81180fb7b580227a162ad",
      "new_mode": 33188,
      "new_path": "python/message.c"
    }
  ]
}