Fix wild pointer in map_key()/map_value() for malformed map_entry descriptors#27163
Fix wild pointer in map_key()/map_value() for malformed map_entry descriptors#27163jortles wants to merge 4 commits intoprotocolbuffers:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
…criptors When BuildFile() with AllowUnknownDependencies() processes a FileDescriptorProto containing a message marked as map_entry with 0 fields (instead of the required 2), map_value() returns field(1) on a 0-element array. The ABSL_DCHECK_EQ(field_count(), 2) guard is a no-op in Release builds (NDEBUG defined), producing a wild pointer. Subsequent calls to cpp_type() on this wild pointer read garbage from adjacent memory and index kTypeToCppTypeMap out of bounds. Fix: 1. Change ABSL_DCHECK_EQ to ABSL_CHECK_EQ in map_key() and map_value() so the invariant is enforced in all build configurations. 2. Add validation in BuildMessage() to reject map_entry messages that don't have exactly 2 fields, catching the problem at descriptor build time before map_key()/map_value() can be called.
jortles
force-pushed
the
fix-map-entry-wild-pointer
branch
from
ae83cef to
264c869
Compare
|
Hi — the related PR #27218 (which fixed the
While #27218 closes the entry point, these checks would independently prevent exploitation if another path to a malformed |
2 participants
Summary
Descriptor::map_key()andmap_value()useABSL_DCHECK_EQ(field_count(), 2)to guard against invalid map_entry descriptors. SinceABSL_DCHECKis a no-op in Release builds (NDEBUGdefined), a malformed map_entry descriptor with 0 fields causesfield(1)to return a wild pointer. Subsequent calls tocpp_type()on this wild pointer read garbage and indexkTypeToCppTypeMapout of bounds, producing a global-buffer-overflow.Trigger path
DescriptorPool::BuildFile()withAllowUnknownDependencies()accepts aFileDescriptorProtocontaining a message withoptions.map_entry = trueand 0 fieldsDynamicMessageFactory::GetPrototype()+Message::ParseFromArray()on that messageIsInitialized(),ReflectionOpscallsdescriptor->map_value()which returns&fields_[1]on a 0-element array (wild pointer)field->cpp_type()reads garbagetype_from the wild pointer and indexeskTypeToCppTypeMap[garbage]out of boundsBehavior by build type
Fix
ABSL_DCHECK_EQ→ABSL_CHECK_EQinmap_key()andmap_value()so the invariant is enforced in all build configurationsBuildMessage()to reject map_entry messages withfield_count() != 2at descriptor build time, beforemap_key()/map_value()can be calledTesting
Verified with a 95-byte crafted
FileDescriptorProtoinput:AddressSanitizer: global-buffer-overflowinFieldDescriptor::cpp_type()atdescriptor.h:3164BuildFile()rejects the input with error "Map entry message must have exactly 2 fields (key and value)." — clean exit, no crash