[ObjC] Fix over-release in GPBTextFormatForMessage

When handling deeply nested unknown fields, the `subIndent` string was being over-released in `GPBTextFormatForMessage`, leading to crashes when generating text format for messages with deeply nested unknown fields.

The added test case reproduces this crash by creating a message with unknown fields nested deep enough to cause the indent string to be heap-allocated, and then adding siblings at that depth, triggering the incorrect release.

Removing the redundant `[subIndent release]` resolves the issue.

PiperOrigin-RevId: 895495564
This commit is contained in:
Protobuf Team Bot 2026-04-06 14:12:54 -07:00 committed by Copybara-Service
parent e96c5ecd07
commit 18f4d6130e
2 changed files with 24 additions and 1 deletions

View file

@ -1987,7 +1987,7 @@ static void AppendTextFormatForUnknownFields(GPBUnknownFields *ufs, NSMutableStr
} break;
}
}
[subIndent release];
[sortedFields release];
}

View file

@ -214,6 +214,29 @@
XCTAssertEqualObjects(expected, result);
}
- (void)testTextFormatUnknownFieldsCrash {
GPBUnknownFields *ufs = [[[GPBUnknownFields alloc] init] autorelease];
GPBUnknownFields *current = ufs;
// Nest single groups deep enough to force a heap-allocated indent string.
for (int i = 0; i < 15; ++i) {
current = [current addGroupWithFieldNumber:150];
}
// Now add multiple siblings at that deep level to trigger reuse/release.
for (int i = 0; i < 10; ++i) {
GPBUnknownFields *sibling = [current addGroupWithFieldNumber:151];
[sibling addFieldNumber:1 varint:1];
}
TestEmptyMessage *message = [TestEmptyMessage message];
XCTAssertTrue([message mergeUnknownFields:ufs extensionRegistry:nil error:NULL]);
@autoreleasepool {
[message description];
}
}
- (void)testSetRepeatedFields {
TestAllTypes *message = [TestAllTypes message];