Google Git Google Git
Sign in
flutter/third_party/protobuf/87852d6063537736bc096d3b3dd7edfd64368c22
commit
87852d6063537736bc096d3b3dd7edfd64368c22
[log]
author
carlos-al <carlos.antolin.lucas@gmail.com>
Wed Oct 14 12:16:45 2026 -0700
committer
Copybara-Service <copybara-worker@google.com>
Wed Oct 14 12:24:29 2026 -0700
tree
67fe817e07a0fbe9ac8de93217a458400d66f650
parent
ad1feecd7c923e4d81deb313f446283055f4e0a7 [diff] 
fix: [C++] prevent out-of-bounds writes in Cord map entries (#29171)

## Summary

  This PR fixes an out-of-bounds write when parsing Cord-enabled bytes values in compiler-generated C++ map entries.

  ## Analysis

  A file-level Cord feature could propagate to a synthetic map-entry value even though its generated member uses string-backed `ArenaStringPtr` storage.

  The generated parse table consequently described the 8-byte member as a 16-byte Cord. Parsing an inline Cord could write eight bytes beyond the 40-byte map-entry object and corrupt adjacent memory.

  ## The Fix

  Normalize synthetic map-entry fields to their physical string representation during descriptor processing.

  For compatibility with previously generated code, also normalize stale Cord metadata when parsing a synthetic map-entry value.

  ## Testing

  - Added regression coverage for current generated metadata
  - Added heap and Arena coverage for previously generated stale metadata
  - Confirmed that removing the parser defense triggers an ASan-detected invalid access
  - Confirmed that the fixed tests pass under GCC ASan
  - Ran  `bazel test //src/google/protobuf:all`, which selected relevant C++ test suite: 55 tests passed

Closes #29171

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/29171 from carlos-al:fix/cord-map-entry-representation-main 49aa96b686637209178164832317978ce8744881
PiperOrigin-RevId: 999533082
3 files changed
tree: 67fe817e07a0fbe9ac8de93217a458400d66f650
  1. .bazelci/
  2. .bcr/
  3. .github/
  4. bazel/
  5. benchmarks/
  6. build_defs/
  7. ci/
  8. cmake/
  9. compatibility/
  10. conformance/
  11. csharp/
  12. docs/
  13. editions/
  14. editors/
  15. examples/
  16. go/
  17. hpb/
  18. hpb_generator/
  19. java/
  20. lua/
  21. objectivec/
  22. patches/
  23. php/
  24. pkg/
  25. python/
  26. ruby/
  27. rust/
  28. src/
  29. third_party/
  30. toolchain/
  31. upb/
  32. upb_generator/
  33. .bazelignore
  34. .bazeliskrc
  35. .bazelrc
  36. .clang-format
  37. .gitattributes
  38. .gitignore
  39. .gitmodules
  40. .readthedocs.yml
  41. appveyor.bat
  42. appveyor.yml
  43. bazel9.bazelrc
  44. BUILD.bazel
  45. CMakeLists.txt
  46. CODE_OF_CONDUCT.md
  47. CONTRIBUTING.md
  48. CONTRIBUTORS.txt
  49. Disable_bundle_install.patch
  50. fix_permissions.sh
  51. generate_descriptor_proto.sh
  52. global.json
  53. google3_export_generated_files.sh
  54. LICENSE
  55. maven_dev_install.json
  56. maven_install.json
  57. MODULE.bazel
  58. PrivacyInfo.xcprivacy
  59. protobuf.bzl
  60. Protobuf.podspec
  61. protobuf_deps.bzl
  62. protobuf_release.bzl
  63. protobuf_version.bzl
  64. README.md
  65. regenerate_stale_files.sh
  66. SECURITY.md
  67. version.json
  68. WORKSPACE
  69. WORKSPACE.bzlmod
README.md

Protocol Buffers - Google's data interchange format

OpenSSF Scorecard

Copyright 2008 Google LLC

Overview

Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can learn more about it in protobuf's documentation.

This README file contains protobuf installation instructions. To install protobuf, you need to install the protocol compiler (used to compile .proto files) and the protobuf runtime for your chosen programming language.

Working With Protobuf Source Code

Most users will find working from supported releases to be the easiest path.

If you choose to work from the head revision of the main branch your build will occasionally be broken by source-incompatible changes and insufficiently-tested (and therefore broken) behavior.

If you are using C++ or otherwise need to build protobuf from source as a part of your project, you should pin to a release commit on a release branch.

This is because even release branches can experience some instability in between release commits.

Bazel with Bzlmod

Protobuf supports Bzlmod with Bazel 8 +. Users should specify a dependency on protobuf in their MODULE.bazel file as follows.

bazel_dep(name = "protobuf", version = <VERSION>)

Users can optionally override the repo name, such as for compatibility with WORKSPACE.

bazel_dep(name = "protobuf", version = <VERSION>, repo_name = "com_google_protobuf")

Bazel with WORKSPACE

Users can also add the following to their legacy WORKSPACE file.

Note that with the release of 30.x there are a few more load statements to properly set up rules_java and rules_python.

http_archive(
    name = "com_google_protobuf",
    strip_prefix = "protobuf-VERSION",
    sha256 = ...,
    url = ...,
)

load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")

protobuf_deps()

load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")

rules_java_dependencies()

load("@rules_java//java:repositories.bzl", "rules_java_toolchains")

rules_java_toolchains()

load("@rules_python//python:repositories.bzl", "py_repositories")

py_repositories()

Protobuf Compiler Installation

The protobuf compiler is written in C++. If you are using C++, please follow the C++ Installation Instructions to install protoc along with the C++ runtime.

For non-C++ users, the simplest way to install the protocol compiler is to download a pre-built binary from our GitHub release page.

In the downloads section of each release, you can find pre-built binaries in zip packages: protoc-$VERSION-$PLATFORM.zip. It contains the protoc binary as well as a set of standard .proto files distributed along with protobuf.

If you are looking for an old version that is not available in the release page, check out the Maven repository.

These pre-built binaries are only provided for released versions. If you want to use the github main version at HEAD, or you need to modify protobuf code, or you are using C++, it's recommended to build your own protoc binary from source.

If you would like to build protoc binary from source, see the C++ Installation Instructions.

Protobuf Runtime Installation

Protobuf supports several different programming languages. For each programming language, you can find instructions in the corresponding source directory about how to install protobuf runtime for that specific language:

LanguageSource
C++ (include C++ runtime and protoc)src
Javajava
Pythonpython
Objective-Cobjectivec
C#csharp
Rubyruby
Goprotocolbuffers/protobuf-go
PHPphp
Dartdart-lang/protobuf
JavaScriptprotocolbuffers/protobuf-javascript

Quick Start

The best way to learn how to use protobuf is to follow the tutorials in our developer guide.

If you want to learn from code examples, take a look at the examples in the examples directory.

Documentation

The complete documentation is available at the Protocol Buffers doc site.

Support Policy

Read about our version support policy to stay current on support timeframes for the language libraries.

Developer Community

To be alerted to upcoming changes in Protocol Buffers and connect with protobuf developers and users, join the Google Group.