Fix out-of-bounds vector access in StructDef::Deserialize (#8988)
* Fix out-of-bounds vector access in StructDef::Deserialize
* Fix syntax: use error_ instead of error()
diff --git a/src/idl_parser.cpp b/src/idl_parser.cpp
index fe2878a..b1bdffa 100644
--- a/src/idl_parser.cpp
+++ b/src/idl_parser.cpp
@@ -4132,7 +4132,15 @@
sortbysize = attributes.Lookup("original_order") == nullptr && !fixed;
const auto& of = *(object->fields());
auto indexes = std::vector<uoffset_t>(of.size());
- for (uoffset_t i = 0; i < of.size(); i++) indexes[of.Get(i)->id()] = i;
+ for (uoffset_t i = 0; i < of.size(); i++) {
+ uint16_t field_id = of.Get(i)->id();
+ if (field_id >= of.size()) {
+ parser.error_ = "Field ID " + std::to_string(field_id) +
+ " exceeds field count " + std::to_string(of.size());
+ return false;
+ }
+ indexes[field_id] = i;
+}
size_t tmp_struct_size = 0;
for (size_t i = 0; i < indexes.size(); i++) {
auto field = of.Get(indexes[i]);