fix: add buffer verification in GenTextFile to prevent OOB heap reads

[Ashutosh0x]

Fixes #9051

Summary

GenTextFile() passes the internal buffer to GenText() without running the Verifier first. When a binary FlatBuffer has a corrupted vector length field, GenText() iterates past the buffer boundary, causing heap-buffer-overflow reads in release builds (where FLATBUFFERS_ASSERT is stripped).

This is exploitable: flatc --json schema.fbs -- corrupt.bin silently reads and outputs heap memory as JSON array elements, constituting information disclosure (CWE-125).

Root Cause

Vector::Get() uses FLATBUFFERS_ASSERT for bounds checking, which is a no-op in release builds. The GenText() path trusts the vector length from the buffer without verification, unlike the FlexBuffers path which calls VerifyBuffer() in flatc.cpp.

Fix

Add Verifier check in GenTextFile() before calling GenText(). This is consistent with how the FlexBuffers path already verifies buffers before ToString(). The verifier rejects corrupt buffers with an error message rather than silently reading OOB memory.

Testing

The fix can be verified with the PoC from #9051:

1. Create a valid binary with flatc -b schema.fbs valid.json
2. Corrupt the vector length field
3. flatc --json schema.fbs -- corrupt.bin now returns an error instead of leaking heap contents

[Ashutosh0x]

Hi @dbaileychess — Requesting review on this security fix. It adds flatbuffers::Verifier buffer check in GenTextFile() to prevent OOB heap reads from crafted binaries. Related to issue #9051. Thanks!

[Ashutosh0x]

Friendly ping @jtdavis777 @dbaileychess — this is a security fix for #9051 (OOB heap read in flatc --json). The fix adds a Verifier check in GenTextFile() before calling GenText(), consistent with how the FlexBuffers path already verifies buffers. CI is green. Would appreciate a review when you get a chance.