Skip to content

Fix heap buffer overflow in StructDef::Deserialize (.bfbs files) #9115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ashutosh0x wants to merge 1 commit into
base: master
Choose a base branch
from
+30 −8
Open

Fix heap buffer overflow in StructDef::Deserialize (.bfbs files) #9115

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 30 additions & 8 deletions src/idl_parser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4130,15 +4130,32 @@ bool StructDef::Deserialize(Parser& parser, const reflection::Object* object) {
name = parser.UnqualifiedName(object->name()->str());
predecl = false;
sortbysize = attributes.Lookup("original_order") == nullptr && !fixed;
const auto& of = *(object->fields());
auto indexes = std::vector<uoffset_t>(of.size());
for (uoffset_t i = 0; i < of.size(); i++) {
uint16_t field_id = of.Get(i)->id();
if (field_id >= of.size()) {
auto fields_ptr = object->fields();
if (!fields_ptr || fields_ptr->size() == 0) {
parser.error_ = "Object has no fields";
return false;
}
const auto& of = *fields_ptr;
const auto field_count = of.size();
auto indexes = std::vector<uoffset_t>(field_count);
std::vector<bool> id_used(field_count, false);
for (uoffset_t i = 0; i < field_count; i++) {
auto field_ptr = of.Get(i);
if (!field_ptr) {
parser.error_ = "Null field at index " + std::to_string(i);
return false;
}
uint16_t field_id = field_ptr->id();
if (field_id >= field_count) {
parser.error_ = "Field ID " + std::to_string(field_id) +
" exceeds field count " + std::to_string(of.size());
" exceeds field count " + std::to_string(field_count);
return false;
}
if (id_used[field_id]) {
parser.error_ = "Duplicate field ID " + std::to_string(field_id);
return false;
}
id_used[field_id] = true;
indexes[field_id] = i;
}
size_t tmp_struct_size = 0;
Expand Down Expand Up @@ -4313,9 +4330,13 @@ Offset<reflection::Enum> EnumDef::Serialize(FlatBufferBuilder* builder,

bool EnumDef::Deserialize(Parser& parser, const reflection::Enum* _enum) {
name = parser.UnqualifiedName(_enum->name()->str());
for (uoffset_t i = 0; i < _enum->values()->size(); ++i) {
auto values_ptr = _enum->values();
if (!values_ptr) {
return false;
}
for (uoffset_t i = 0; i < values_ptr->size(); ++i) {
auto val = new EnumVal();
if (!val->Deserialize(parser, _enum->values()->Get(i)) ||
if (!val->Deserialize(parser, values_ptr->Get(i)) ||
vals.Add(val->name, val)) {
delete val;
return false;
Expand Down Expand Up @@ -4520,6 +4541,7 @@ bool Parser::Deserialize(const reflection::Schema* schema) {
if (schema->fbs_files())
for (auto s = schema->fbs_files()->begin(); s != schema->fbs_files()->end();
++s) {
if (!s->included_filenames()) continue;
for (auto f = s->included_filenames()->begin();
f != s->included_filenames()->end(); ++f) {
IncludedFile included_file;
Expand Down