Skip to content

Harden reflection verifier against malformed schemas#9169

Open
M0nd0R wants to merge 1 commit into
google:masterfrom
M0nd0R:security/reflection-verifier-malformed-schema
Open

Harden reflection verifier against malformed schemas#9169
M0nd0R wants to merge 1 commit into
google:masterfrom
M0nd0R:security/reflection-verifier-malformed-schema

Conversation

@M0nd0R

@M0nd0R M0nd0R commented Jul 9, 2026

Copy link
Copy Markdown

Summary

  • reject zero or negative reflected struct sizes before struct/vector verification uses them
  • reject vector-of-union fields whose value vector is present but the companion type vector is missing
  • add C++ reflection regression tests for both malformed-schema cases

Validation

  • g++ -std=c++11 -Iinclude /tmp/flatbuffers_reflection_union_poc.cpp src/reflection.cpp src/util.cpp -o /tmp/flatbuffers_reflection_union_poc && /tmp/flatbuffers_reflection_union_poc returned Verify returned 0 after the fix; before the fix it crashed with SIGSEGV at flatbuffers::Vector<unsigned char>::size()
  • g++ -std=c++11 -Iinclude /tmp/flatbuffers_reflection_struct_size_poc.cpp src/reflection.cpp src/util.cpp -o /tmp/flatbuffers_reflection_struct_size_poc && /tmp/flatbuffers_reflection_struct_size_poc returned Verify returned 0 after the fix; before the fix it crashed with SIGFPE in VerifierTemplate::VerifyVectorOrString()
  • cmake -S . -B /tmp/flatbuffers-build -DCMAKE_BUILD_TYPE=Debug -DFLATBUFFERS_BUILD_TESTS=ON -DFLATBUFFERS_BUILD_FLATC=ON -DFLATBUFFERS_BUILD_FLATLIB=ON -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_BUILD_GRPCTEST=OFF
  • cmake --build /tmp/flatbuffers-build --target flattests -j2
  • /tmp/flatbuffers-build/flattests
  • ctest --test-dir /tmp/flatbuffers-build --output-on-failure -R flattests
  • git diff --check

clang-format was not available in this environment, so I validated formatting through compile/test plus git diff --check.

@M0nd0R M0nd0R requested a review from dbaileychess as a code owner July 9, 2026 20:04
@github-actions github-actions Bot added c++ codegen Involving generating code from schema labels Jul 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ codegen Involving generating code from schema

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant