Skip to content

Commit d70f077

Browse files
zhangskzzhangskz
authored
Merge pull request #18191 from protocolbuffers/cp-ruby-upb
Fix a potential Ruby-upb use of uninitialized memory.
2 parents 5b4b3af + 60e585c commit d70f077

File tree

8 files changed

+78
-13
lines changed

8 files changed

+78
-13
lines changed

‎php/ext/google/protobuf/php-upb.c

+1-4
Original file line numberDiff line numberDiff line change
@@ -3083,7 +3083,6 @@ static upb_MessageValue jsondec_int(jsondec* d, const upb_FieldDef* f) {
30833083
/* Parse UINT32 or UINT64 value. */
30843084
static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
30853085
upb_MessageValue val;
3086-
memset(&val, 0, sizeof(val));
30873086

30883087
switch (jsondec_peek(d)) {
30893088
case JD_NUMBER: {
@@ -3121,7 +3120,6 @@ static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
31213120
static upb_MessageValue jsondec_double(jsondec* d, const upb_FieldDef* f) {
31223121
upb_StringView str;
31233122
upb_MessageValue val;
3124-
memset(&val, 0, sizeof(val));
31253123

31263124
switch (jsondec_peek(d)) {
31273125
case JD_NUMBER:
@@ -15769,8 +15767,7 @@ bool upb_Message_Next(const upb_Message* msg, const upb_MessageDef* m,
1576915767
const upb_MiniTable* mt = upb_MessageDef_MiniTable(m);
1577015768
size_t i = *iter;
1577115769
size_t n = upb_MiniTable_FieldCount(mt);
15772-
upb_MessageValue zero;
15773-
memset(&zero, 0, sizeof(zero));
15770+
upb_MessageValue zero = upb_MessageValue_Zero();
1577415771
UPB_UNUSED(ext_pool);
1577515772

1577615773
// Iterate over normal fields, returning the first one that is set.

‎php/ext/google/protobuf/php-upb.h

+24
Original file line numberDiff line numberDiff line change
@@ -1046,7 +1046,14 @@ UPB_API_INLINE size_t upb_Array_Size(const struct upb_Array* arr) {
10461046
#define UPB_MESSAGE_VALUE_H_
10471047

10481048
#include <stdint.h>
1049+
#include <string.h>
1050+
1051+
1052+
// Must be last.
10491053

1054+
#ifdef __cplusplus
1055+
extern "C" {
1056+
#endif
10501057

10511058
typedef union {
10521059
bool bool_val;
@@ -1068,12 +1075,29 @@ typedef union {
10681075
uintptr_t tagged_msg_val; // upb_TaggedMessagePtr
10691076
} upb_MessageValue;
10701077

1078+
UPB_API_INLINE upb_MessageValue upb_MessageValue_Zero(void) {
1079+
upb_MessageValue zero;
1080+
memset(&zero, 0, sizeof(zero));
1081+
return zero;
1082+
}
1083+
10711084
typedef union {
10721085
struct upb_Array* array;
10731086
struct upb_Map* map;
10741087
struct upb_Message* msg;
10751088
} upb_MutableMessageValue;
10761089

1090+
UPB_API_INLINE upb_MutableMessageValue upb_MutableMessageValue_Zero(void) {
1091+
upb_MutableMessageValue zero;
1092+
memset(&zero, 0, sizeof(zero));
1093+
return zero;
1094+
}
1095+
1096+
#ifdef __cplusplus
1097+
} /* extern "C" */
1098+
#endif
1099+
1100+
10771101
#endif /* UPB_MESSAGE_VALUE_H_ */
10781102

10791103
#ifndef UPB_MINI_TABLE_FIELD_H_

‎ruby/ext/google/protobuf_c/defs.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -726,7 +726,7 @@ static VALUE FieldDescriptor__type(VALUE _self) {
726726
static VALUE FieldDescriptor_default(VALUE _self) {
727727
FieldDescriptor* self = ruby_to_FieldDescriptor(_self);
728728
const upb_FieldDef* f = self->fielddef;
729-
upb_MessageValue default_val = {0};
729+
upb_MessageValue default_val = upb_MessageValue_Zero();
730730
if (upb_FieldDef_IsSubMessage(f)) {
731731
return Qnil;
732732
} else if (!upb_FieldDef_IsRepeated(f)) {

‎ruby/ext/google/protobuf_c/ruby-upb.c

+1-4
Original file line numberDiff line numberDiff line change
@@ -2571,7 +2571,6 @@ static upb_MessageValue jsondec_int(jsondec* d, const upb_FieldDef* f) {
25712571
/* Parse UINT32 or UINT64 value. */
25722572
static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
25732573
upb_MessageValue val;
2574-
memset(&val, 0, sizeof(val));
25752574

25762575
switch (jsondec_peek(d)) {
25772576
case JD_NUMBER: {
@@ -2609,7 +2608,6 @@ static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
26092608
static upb_MessageValue jsondec_double(jsondec* d, const upb_FieldDef* f) {
26102609
upb_StringView str;
26112610
upb_MessageValue val;
2612-
memset(&val, 0, sizeof(val));
26132611

26142612
switch (jsondec_peek(d)) {
26152613
case JD_NUMBER:
@@ -15257,8 +15255,7 @@ bool upb_Message_Next(const upb_Message* msg, const upb_MessageDef* m,
1525715255
const upb_MiniTable* mt = upb_MessageDef_MiniTable(m);
1525815256
size_t i = *iter;
1525915257
size_t n = upb_MiniTable_FieldCount(mt);
15260-
upb_MessageValue zero;
15261-
memset(&zero, 0, sizeof(zero));
15258+
upb_MessageValue zero = upb_MessageValue_Zero();
1526215259
UPB_UNUSED(ext_pool);
1526315260

1526415261
// Iterate over normal fields, returning the first one that is set.

‎ruby/ext/google/protobuf_c/ruby-upb.h

+24
Original file line numberDiff line numberDiff line change
@@ -1048,7 +1048,14 @@ UPB_API_INLINE size_t upb_Array_Size(const struct upb_Array* arr) {
10481048
#define UPB_MESSAGE_VALUE_H_
10491049

10501050
#include <stdint.h>
1051+
#include <string.h>
1052+
1053+
1054+
// Must be last.
10511055

1056+
#ifdef __cplusplus
1057+
extern "C" {
1058+
#endif
10521059

10531060
typedef union {
10541061
bool bool_val;
@@ -1070,12 +1077,29 @@ typedef union {
10701077
uintptr_t tagged_msg_val; // upb_TaggedMessagePtr
10711078
} upb_MessageValue;
10721079

1080+
UPB_API_INLINE upb_MessageValue upb_MessageValue_Zero(void) {
1081+
upb_MessageValue zero;
1082+
memset(&zero, 0, sizeof(zero));
1083+
return zero;
1084+
}
1085+
10731086
typedef union {
10741087
struct upb_Array* array;
10751088
struct upb_Map* map;
10761089
struct upb_Message* msg;
10771090
} upb_MutableMessageValue;
10781091

1092+
UPB_API_INLINE upb_MutableMessageValue upb_MutableMessageValue_Zero(void) {
1093+
upb_MutableMessageValue zero;
1094+
memset(&zero, 0, sizeof(zero));
1095+
return zero;
1096+
}
1097+
1098+
#ifdef __cplusplus
1099+
} /* extern "C" */
1100+
#endif
1101+
1102+
10791103
#endif /* UPB_MESSAGE_VALUE_H_ */
10801104

10811105
#ifndef UPB_MINI_TABLE_FIELD_H_

‎upb/json/decode.c

-2
Original file line numberDiff line numberDiff line change
@@ -712,7 +712,6 @@ static upb_MessageValue jsondec_int(jsondec* d, const upb_FieldDef* f) {
712712
/* Parse UINT32 or UINT64 value. */
713713
static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
714714
upb_MessageValue val;
715-
memset(&val, 0, sizeof(val));
716715

717716
switch (jsondec_peek(d)) {
718717
case JD_NUMBER: {
@@ -750,7 +749,6 @@ static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
750749
static upb_MessageValue jsondec_double(jsondec* d, const upb_FieldDef* f) {
751750
upb_StringView str;
752751
upb_MessageValue val;
753-
memset(&val, 0, sizeof(val));
754752

755753
switch (jsondec_peek(d)) {
756754
case JD_NUMBER:

‎upb/message/value.h

+26
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,17 @@
1212
#define UPB_MESSAGE_VALUE_H_
1313

1414
#include <stdint.h>
15+
#include <string.h>
1516

1617
#include "upb/base/string_view.h"
1718

19+
// Must be last.
20+
#include "upb/port/def.inc"
21+
22+
#ifdef __cplusplus
23+
extern "C" {
24+
#endif
25+
1826
typedef union {
1927
bool bool_val;
2028
float float_val;
@@ -35,10 +43,28 @@ typedef union {
3543
uintptr_t tagged_msg_val; // upb_TaggedMessagePtr
3644
} upb_MessageValue;
3745

46+
UPB_API_INLINE upb_MessageValue upb_MessageValue_Zero(void) {
47+
upb_MessageValue zero;
48+
memset(&zero, 0, sizeof(zero));
49+
return zero;
50+
}
51+
3852
typedef union {
3953
struct upb_Array* array;
4054
struct upb_Map* map;
4155
struct upb_Message* msg;
4256
} upb_MutableMessageValue;
4357

58+
UPB_API_INLINE upb_MutableMessageValue upb_MutableMessageValue_Zero(void) {
59+
upb_MutableMessageValue zero;
60+
memset(&zero, 0, sizeof(zero));
61+
return zero;
62+
}
63+
64+
#ifdef __cplusplus
65+
} /* extern "C" */
66+
#endif
67+
68+
#include "upb/port/undef.inc"
69+
4470
#endif /* UPB_MESSAGE_VALUE_H_ */

‎upb/reflection/message.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -138,8 +138,7 @@ bool upb_Message_Next(const upb_Message* msg, const upb_MessageDef* m,
138138
const upb_MiniTable* mt = upb_MessageDef_MiniTable(m);
139139
size_t i = *iter;
140140
size_t n = upb_MiniTable_FieldCount(mt);
141-
upb_MessageValue zero;
142-
memset(&zero, 0, sizeof(zero));
141+
upb_MessageValue zero = upb_MessageValue_Zero();
143142
UPB_UNUSED(ext_pool);
144143

145144
// Iterate over normal fields, returning the first one that is set.

0 commit comments

Comments
 (0)