mirror of
https://github.com/protocolbuffers/protobuf
synced 2026-08-26 02:23:14 -04:00
dd9d2ad02d
## Summary `GPBMessage::parseMessageSet:` reads each MessageSet item's payload bytes into a separate buffer (because the type-id and payload tags can appear in any order), then allocates a fresh `GPBCodedInputStream` to decode that buffer. The fresh stream's `state_.recursionDepth` starts at `0` even when the parent stream is already several MessageSet items deep, so a chain of nested MessageSet items grows the native call stack without ever tripping the documented `kDefaultRecursionLimit` (100). Other parser entry points that recurse on the same stream (`readGroup:`, `readMessage:`, `readMapEntry:`, `SkipToEndGroupInternal`) already increment and check `recursionDepth`; the MessageSet path was the only spot where depth tracking did not cross the stream boundary. This change adds a package-private `-initWithData:parentRecursionDepth:` initializer to `GPBCodedInputStream` that seeds the child stream's depth from the parent's and runs `CheckRecursionLimit` before parsing begins. To prevent memory leaks if `CheckRecursionLimit` raises an exception during initialization, the check is wrapped in a `@try/@catch` block that releases `self`. `parseMessageSet:` uses that initializer, so depth tracking carries across the fresh stream. This mirrors the depth-inheritance done by the C++ `ParseContext` spawn helper. Regression coverage: `testParseMessageSetRecursionDepthCarriedFromParent` in `GPBWireFormatTests` builds MessageSet-of-MessageSet payloads (each layer is `MSetMessage -> MSetMessageExtension1.recursive -> MSetMessage -> ...`, adding 2 to the recursion depth per layer). It verifies that 50 layers (depth 100, `kDefaultRecursionLimit`) parses successfully, while 51 layers (depth 101, `kDefaultRecursionLimit + 1`) fails with `GPBCodedInputStreamErrorRecursionDepthExceeded`. Existing `testErrorRecursionDepthReached` and the rest of `GPBWireFormatTests` continue to pass unchanged. ## Test plan - Existing ObjC test suite passes (`GPBWireFormatTests`, `GPBMessageTests+Serialization`, `GPBCodedInputStreamTests`, `GPBUnknownFieldsTest`). - New `testParseMessageSetRecursionDepthCarriedFromParent` passes for both 50 layers (passing at kDefaultRecursionLimit) and 51 layers (failing at kDefaultRecursionLimit + 1). Closes #27571 PiperOrigin-RevId: 959041690
94 lines
4.3 KiB
Objective-C
94 lines
4.3 KiB
Objective-C
// Protocol Buffers - Google's data interchange format
|
|
// Copyright 2008 Google Inc. All rights reserved.
|
|
//
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file or at
|
|
// https://developers.google.com/open-source/licenses/bsd
|
|
|
|
// This header is private to the ProtobolBuffers library and must NOT be
|
|
// included by any sources outside this library. The contents of this file are
|
|
// subject to change at any time without notice.
|
|
|
|
#import "GPBCodedInputStream.h"
|
|
|
|
#import "GPBDescriptor.h"
|
|
|
|
typedef struct GPBCodedInputStreamState {
|
|
const uint8_t *bytes;
|
|
size_t bufferSize;
|
|
size_t bufferPos;
|
|
|
|
// For parsing subsections of an input stream you can put a hard limit on
|
|
// how much should be read. Normally the limit is the end of the stream,
|
|
// but you can adjust it to anywhere, and if you hit it you will be at the
|
|
// end of the stream, until you adjust the limit.
|
|
size_t currentLimit;
|
|
int32_t lastTag;
|
|
NSUInteger recursionDepth;
|
|
} GPBCodedInputStreamState;
|
|
|
|
@interface GPBCodedInputStream () {
|
|
@package
|
|
struct GPBCodedInputStreamState state_;
|
|
NSData *buffer_;
|
|
}
|
|
|
|
// Initializes a new stream over `data` whose initial recursion depth is one
|
|
// deeper than `parentDepth`. Used when a parser needs to spawn a fresh
|
|
// CodedInputStream to decode a payload that has already been read into a
|
|
// separate buffer (e.g. MessageSet items), so that the native call stack
|
|
// growth is still bounded by kDefaultRecursionLimit. The initializer raises
|
|
// GPBCodedInputStreamErrorRecursionDepthExceeded if `parentDepth` is already
|
|
// at the limit. Mirrors the depth-inheritance done by the C++ ParseContext
|
|
// spawn helper.
|
|
- (instancetype)initWithData:(NSData *)data parentRecursionDepth:(NSUInteger)parentDepth;
|
|
|
|
// Group support is deprecated, so we hide this interface from users, but
|
|
// support for older data.
|
|
- (void)readGroup:(int32_t)fieldNumber
|
|
message:(GPBMessage *)message
|
|
extensionRegistry:(id<GPBExtensionRegistry>)extensionRegistry;
|
|
|
|
// Reads a map entry.
|
|
- (void)readMapEntry:(id)mapDictionary
|
|
extensionRegistry:(id<GPBExtensionRegistry>)extensionRegistry
|
|
field:(GPBFieldDescriptor *)field
|
|
parentMessage:(GPBMessage *)parentMessage;
|
|
@end
|
|
|
|
CF_EXTERN_C_BEGIN
|
|
|
|
void GPBRaiseStreamError(NSInteger code, NSString *reason);
|
|
int32_t GPBCodedInputStreamReadTag(GPBCodedInputStreamState *state);
|
|
|
|
double GPBCodedInputStreamReadDouble(GPBCodedInputStreamState *state);
|
|
float GPBCodedInputStreamReadFloat(GPBCodedInputStreamState *state);
|
|
uint64_t GPBCodedInputStreamReadUInt64(GPBCodedInputStreamState *state);
|
|
uint32_t GPBCodedInputStreamReadUInt32(GPBCodedInputStreamState *state);
|
|
int64_t GPBCodedInputStreamReadInt64(GPBCodedInputStreamState *state);
|
|
int32_t GPBCodedInputStreamReadInt32(GPBCodedInputStreamState *state);
|
|
uint64_t GPBCodedInputStreamReadFixed64(GPBCodedInputStreamState *state);
|
|
uint32_t GPBCodedInputStreamReadFixed32(GPBCodedInputStreamState *state);
|
|
int32_t GPBCodedInputStreamReadEnum(GPBCodedInputStreamState *state);
|
|
int32_t GPBCodedInputStreamReadSFixed32(GPBCodedInputStreamState *state);
|
|
int64_t GPBCodedInputStreamReadSFixed64(GPBCodedInputStreamState *state);
|
|
int32_t GPBCodedInputStreamReadSInt32(GPBCodedInputStreamState *state);
|
|
int64_t GPBCodedInputStreamReadSInt64(GPBCodedInputStreamState *state);
|
|
BOOL GPBCodedInputStreamReadBool(GPBCodedInputStreamState *state);
|
|
NSString *GPBCodedInputStreamReadRetainedString(GPBCodedInputStreamState *state)
|
|
__attribute((ns_returns_retained));
|
|
NSData *GPBCodedInputStreamReadRetainedBytes(GPBCodedInputStreamState *state)
|
|
__attribute((ns_returns_retained));
|
|
NSData *GPBCodedInputStreamReadRetainedBytesNoCopy(GPBCodedInputStreamState *state)
|
|
__attribute((ns_returns_retained));
|
|
NSData *GPBCodedInputStreamReadRetainedBytesToEndGroupNoCopy(GPBCodedInputStreamState *state,
|
|
int32_t fieldNumber)
|
|
__attribute((ns_returns_retained));
|
|
|
|
size_t GPBCodedInputStreamPushLimit(GPBCodedInputStreamState *state, size_t byteLimit);
|
|
void GPBCodedInputStreamPopLimit(GPBCodedInputStreamState *state, size_t oldLimit);
|
|
size_t GPBCodedInputStreamBytesUntilLimit(GPBCodedInputStreamState *state);
|
|
BOOL GPBCodedInputStreamIsAtEnd(GPBCodedInputStreamState *state);
|
|
void GPBCodedInputStreamCheckLastTagWas(GPBCodedInputStreamState *state, int32_t value);
|
|
|
|
CF_EXTERN_C_END
|