)]}'
{
  "commit": "54fc8996c29c65fe9c8d6cb571ff9d2704090d75",
  "tree": "968f274938d3678376b1314aeb9cf4b2c05edc0d",
  "parents": [
    "08163c7a32f5afd7ae69aad96e87fa328adf09ae"
  ],
  "author": {
    "name": "Anthony Hurtado",
    "email": "amhurtado@pm.me",
    "time": "Wed Oct 14 12:03:24 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Wed Oct 14 12:10:22 2026 -0700"
  },
  "message": "Fix integer truncation and missing NULL checks in upb (#27712)\n\n## Summary\n\nFour hardening fixes for upb internals found during security audit:\n\n1. **compare_unknown.c:122-126 — integer truncation + missing NULL check**: `oldsize` and `newsize` are declared as `int` but hold `size_t * sizeof(...)` products. On 64-bit systems, these truncate to 32 bits, causing incorrect `upb_grealloc` arguments at large field counts (~89.5M unknown fields). Also adds missing NULL check after `upb_grealloc`, using the existing `upb_UnknownFields_OutOfMemory()` longjmp handler.\n\n2. **map_sorter.h/map_sorter.c — same integer truncation pattern**: `_upb_mapsorter` struct fields (`size`, `cap`) and `_upb_sortedmap` fields (`start`, `pos`, `end`) are `int` despite `_upb_Map_Size()` returning `size_t`. Same truncation overflow as #1.\n\n3. **copy.c:41 — missing NULL check before memcpy**: `upb_Clone_StringView` calls `upb_Arena_Malloc` then `memcpy` without checking for NULL. The parallel code path in `upb_Clone_MessageValue` (same file, line 67-69) correctly checks.\n\n4. **array.h:83 — missing overflow check in array allocation**: `_upb_Array_NewMaybeAllowSlow` computes `init_capacity \u003c\u003c elem_size_lg2` without overflow guard. The parallel `_upb_Array_Realloc` (`array.c:169-180`) uses `upb_ShlOverflow()`. The combined check `init_capacity \u003e (SIZE_MAX - array_size) \u003e\u003e elem_size_lg2` guards against both shift overflow and the subsequent addition overflow.\n\n## Test plan\n\n- [x] Add `ManyFieldsSortReallocation` test for compare_unknown.c sort buffer reallocation\n- [x] Add `ManyFieldsNotEqual` test verifying differing values detected after sorting\n- [x] Add `NewOverflowCapacityReturnsNull` test for array.h overflow guard\n- [ ] Existing unit tests pass\n\n🔒 Found during security audit of upb internals\n\nCloses #27712\n\nCOPYBARA_INTEGRATE_REVIEW\u003dhttps://github.com/protocolbuffers/protobuf/pull/27712 from jortles:fix-upb-integer-null-hardening 6cbc9ae985655bde93ba4c3d09d14537d77e4142\nPiperOrigin-RevId: 999523263\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6524c7c1c494c8a7a5f3f33bea543e3388d27840",
      "old_mode": 33188,
      "old_path": "upb/message/internal/array.h",
      "new_id": "61311a1303e91640adc04d83288bd84ebd68ec7b",
      "new_mode": 33188,
      "new_path": "upb/message/internal/array.h"
    },
    {
      "type": "modify",
      "old_id": "149608005b6da557d0bb7143b51116f60426e142",
      "old_mode": 33188,
      "old_path": "upb/message/internal/compare_unknown_test.cc",
      "new_id": "812fa5e5b3e521d39145e5488f6a7fe890fade5b",
      "new_mode": 33188,
      "new_path": "upb/message/internal/compare_unknown_test.cc"
    },
    {
      "type": "modify",
      "old_id": "0cf6ee04a58a56b16f12b0172c71393c6db4416d",
      "old_mode": 33188,
      "old_path": "upb/message/internal/map_sorter.h",
      "new_id": "d69da12d451adcd1011ef3ae25ed241ef5460b97",
      "new_mode": 33188,
      "new_path": "upb/message/internal/map_sorter.h"
    },
    {
      "type": "modify",
      "old_id": "2597d0bc4c5b300f1e95f94013138140c4106211",
      "old_mode": 33188,
      "old_path": "upb/message/map_sorter.c",
      "new_id": "f202e61382b4ed81bd301d879f9d7bfb0b831464",
      "new_mode": 33188,
      "new_path": "upb/message/map_sorter.c"
    }
  ]
}