)]}'
{
  "commit": "452153d357017c113ebcb527425428d470feca4c",
  "tree": "4bd1010ee748d59f780a90d328afc53df10ed029",
  "parents": [
    "e75aac33c3615d22d0cba61e8f9d92939a39a73f"
  ],
  "author": {
    "name": "Anthony Hurtado",
    "email": "amhurtado@pm.me",
    "time": "Thu Jun 04 16:47:37 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Thu Jun 04 16:52:50 2026 -0700"
  },
  "message": "Fix integer overflow in upb_Arena_Malloc for near-SIZE_MAX allocations (#27568)\n\n## Summary\n\n- Add overflow guard in `upb_Arena_Malloc` rejecting sizes that would wrap during `UPB_ALIGN_MALLOC` alignment computation\n- `UPB_ALIGN_MALLOC(SIZE_MAX)` computes `((SIZE_MAX + 7) / 8) * 8` which wraps to 0, causing `_upb_Arena_AllocSpan` to return 0 and the fast path to return a pointer without advancing\n- On 32-bit/WASM32, reachable from untrusted wire input via packed bool fields where `_upb_Array_Realloc` capacity doubling overflows to `SIZE_MAX` and `upb_ShlOverflow(\u0026SIZE_MAX, 0)` passes\n\n## Test plan\n\n- [ ] Verify `upb_Arena_Malloc(arena, SIZE_MAX)` returns NULL (previously returned non-NULL)\n- [ ] Verify `upb_Arena_Malloc(arena, SIZE_MAX - 6)` returns NULL (edge case)\n- [ ] Verify `upb_Arena_Malloc(arena, SIZE_MAX - 8)` still works if arena has space\n- [ ] `bazel test //upb/mem:arena_test` passes in both opt and dbg\n\nCloses #27568\n\nCOPYBARA_INTEGRATE_REVIEW\u003dhttps://github.com/protocolbuffers/protobuf/pull/27568 from jortles:fix-upb-arena-alloc-overflow a1bd890de2c715cbfa9d63837d149441d65bac34\nPiperOrigin-RevId: 926957689\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "186779531952fd4615bb0e6fcc3b1d674d38bf73",
      "old_mode": 33188,
      "old_path": "upb/message/array.c",
      "new_id": "6ef5b507150764c2dbd302bd95d7037e0084fa92",
      "new_mode": 33188,
      "new_path": "upb/message/array.c"
    },
    {
      "type": "modify",
      "old_id": "d082e55b344c222a12637a81af399c6369173ec0",
      "old_mode": 33188,
      "old_path": "upb/message/array_test.cc",
      "new_id": "8e5a4507f333226cc36903192e8ff72088ed464f",
      "new_mode": 33188,
      "new_path": "upb/message/array_test.cc"
    }
  ]
}