Fix heap buffer overflow in StructDef::Deserialize (.bfbs files)

[Ashutosh0x]

Summary

Fix for #8932 - Add comprehensive bounds checking, null validation, and duplicate field ID detection when deserializing .bfbs (binary schema) files.

Problem

StructDef::Deserialize in idl_parser.cpp reads field IDs from user-provided .bfbs files and uses them as array indices without adequate validation. This enables a heap buffer overflow of up to 262,140 bytes via crafted .bfbs files.

Vulnerabilities Fixed

1. Null pointer dereference: object->fields() dereferenced without null check (line 4133)
2. Heap buffer overflow: Field IDs used as array indices without bounds checking against actual field count
3. Duplicate field ID collision: Two fields with the same ID silently overwrite each other in the index array, causing incorrect field lookups
4. Null field pointer: Individual field entries not null-checked before access
5. EnumDef null dereference: _enum->values() dereferenced without null check
6. Parser null dereference: s->included_filenames() dereferenced without null check

Supply Chain Impact

FlatBuffers is used by Google, Facebook, Microsoft, and Netflix. .bfbs files are shared via schema registries and processed automatically in CI/CD pipelines. A malicious .bfbs file uploaded to a shared registry could execute arbitrary code on every downstream build system.

Fix

• Added null-check for object->fields() before dereferencing
• Added field_count variable to avoid repeated calls to of.size()
• Added id_used vector to detect duplicate field IDs
• Added null-check for individual field pointers in the loop
• Added null-check for _enum->values() in EnumDef::Deserialize
• Added null-check for s->included_filenames() in Parser::Deserialize

Testing

The fix adds defensive checks that reject malformed .bfbs input with clear error messages. Normal valid .bfbs files are unaffected.

Fixes #8932

[Ashutosh0x]

@dbaileychess Hi! This PR fixes the heap buffer overflow in StructDef::Deserialize reported in #8932. My fix builds on PR #8954 but adds additional protections:

1. Null-check object->fields() before dereferencing (prevents null pointer deref)
2. Duplicate field ID detection via id_used vector (prevents silent index overwrites)
3. Null-check for _enum->values() in EnumDef::Deserialize
4. Null-check for s->included_filenames() in Parser::Deserialize

All CI checks are green (6/6 passed). CLA is signed. The change is +30/-8 lines in a single file (idl_parser.cpp).

Could you please review? This is a supply-chain-relevant vulnerability since .bfbs files are processed in CI/CD pipelines.