Fix clang undefined behavior sanitizer errors.
Signed and unsigned integer overflows, no actual consequences
but clean up the errors.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 3a84290..395e51d 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -11,6 +11,7 @@
Fix field descriptor sizing with submsg_callback option (#545)
Fix protoc calling on Python 2 (#503)
Fix handling of varying NaN representations in PB_CONVERT_DOUBLE_FLOAT (#543)
+ Fix clang undefined behavior sanitizer errors.
Change generator to use Python 3 by default (#441, #509)
Binary packages updated to use Python 3 and grpcio-tools
Add support for infinity and nan floating-point defaults (#530, #538)
@@ -31,6 +32,8 @@
Swift package manager (#549)
Rename BUILD as BUILD.bazel (#537)
+Note: Windows binary packages in 0.4.2 and later require Windows 7 or newer.
+
nanopb-0.4.1 (2020-02-02)
Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
Avoid overflows in allocation for packed fields.
@@ -92,6 +95,12 @@
CMake: Split nanopb_out command (#454)
CMake: install created shared library(dll) in windows to the binary folder (#447)
+nanopb-0.3.9.6 (2020-06-23)
+ Fix buffer overflow when encoding bytes with size set to 65535 (#547, GHSA-3p39-mfxg-hrq4)
+ Fix proto3 submessage improperly considered empty (#504)
+ Fix ImportError when using generator/protoc with Python 3
+ Add build rules for Swift package manager (#549)
+
nanopb-0.3.9.5 (2020-02-02)
Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
Add workaround for avr-libc realloc() bug (#475)
@@ -263,6 +272,10 @@
Added #if version guard to generated files (issue 129)
Added migration document
+nanopb-0.2.9.5 (2020-06-23)
+ Fix buffer overflow when encoding bytes with size set to 65535 (#547, GHSA-3p39-mfxg-hrq4)
+ Backport Python 3 and protoc 3.x fixes to test cases
+
nanopb-0.2.9.4 (2020-02-02)
Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
Add workaround for avr-libc realloc() bug (#475)
diff --git a/pb_common.c b/pb_common.c
index dfc5a05..636d73a 100644
--- a/pb_common.c
+++ b/pb_common.c
@@ -151,6 +151,11 @@
iter->descriptor = desc;
iter->message = message;
+ if (!desc || !message)
+ {
+ return false;
+ }
+
return load_descriptor_values(iter);
}
diff --git a/pb_decode.c b/pb_decode.c
index 41d895d..484c1cd 100644
--- a/pb_decode.c
+++ b/pb_decode.c
@@ -819,7 +819,7 @@
pb_field_iter_t iter;
if (!pb_field_iter_begin_extension(&iter, extension))
- PB_RETURN_ERROR(stream, "invalid extension");
+ return true; /* Empty field list or extension->dest is null for static fields */
if (iter.tag != tag)
return true;
@@ -1277,7 +1277,7 @@
if (field->pData)
{
- while (count--)
+ for (; count > 0; count--)
{
pb_release(field->submsg_desc, field->pData);
field->pData = (char*)field->pData + field->data_size;
@@ -1294,7 +1294,7 @@
/* Release entries in repeated string or bytes array */
void **pItem = *(void***)field->pField;
pb_size_t count = *(pb_size_t*)field->pSize;
- while (count--)
+ for (; count > 0; count--)
{
pb_free(*pItem);
*pItem++ = NULL;
diff --git a/pb_encode.c b/pb_encode.c
index dad33c8..aee120b 100644
--- a/pb_encode.c
+++ b/pb_encode.c
@@ -833,7 +833,6 @@
static bool checkreturn pb_enc_bytes(pb_ostream_t *stream, const pb_field_iter_t *field)
{
const pb_bytes_array_t *bytes = NULL;
- size_t allocsize;
bytes = (const pb_bytes_array_t*)field->pData;
@@ -843,9 +842,8 @@
return pb_encode_string(stream, NULL, 0);
}
- allocsize = PB_BYTES_ARRAY_T_ALLOCSIZE(bytes->size);
- if (allocsize < bytes->size ||
- (PB_ATYPE(field->type) == PB_ATYPE_STATIC && allocsize > field->data_size))
+ if ((size_t)bytes->size > ((size_t)-1) - offsetof(pb_bytes_array_t, bytes) ||
+ (PB_ATYPE(field->type) == PB_ATYPE_STATIC && PB_BYTES_ARRAY_T_ALLOCSIZE(bytes->size) > field->data_size))
{
PB_RETURN_ERROR(stream, "bytes size exceeded");
}
