Fixed a fuzz bug when a negative oneof_index is provided.

PiperOrigin-RevId: 647789835

upb/reflection/field_def.c

diff --git a/upb/reflection/field_def.c b/upb/reflection/field_def.c
index c18f621..9f2775b 100644
--- a/upb/reflection/field_def.c
+++ b/upb/reflection/field_def.c
@@ -648,7 +648,7 @@
                            f->full_name);
     }
 
-    if (oneof_index >= upb_MessageDef_OneofCount(m)) {
+    if (oneof_index < 0 || oneof_index >= upb_MessageDef_OneofCount(m)) {
       _upb_DefBuilder_Errf(ctx, "oneof_index out of range (%s)", f->full_name);
     }
 

upb/util/def_to_proto_test.cc

diff --git a/upb/util/def_to_proto_test.cc b/upb/util/def_to_proto_test.cc
index 0c7b203..e14b8c4 100644
--- a/upb/util/def_to_proto_test.cc
+++ b/upb/util/def_to_proto_test.cc
@@ -333,4 +333,15 @@
            })pb"));
 }
 
+TEST(FuzzTest, NegativeOneofIndex) {
+  RoundTripDescriptor(ParseTextProtoOrDie(
+      R"pb(file {
+             message_type {
+               name: "A"
+               field { name: "A" number: 0 type_name: "" oneof_index: -1 }
+             }
+           }
+      )pb"));
+}
+
 }  // namespace upb_test