OrbisAI Security 3a48173d7e fix: Harden SIMD UTF-8 tail-copy bounds checks (#26797) ... ## Summary This PR hardens the SIMD UTF-8 validation tail-copy paths in `third_party/utf8_range`. The AVX2 and SSE implementations copy the remaining input bytes into fixed-size stack buffers before processing the final partial block. This change makes the copy length explicitly derived from `size_t` input length arithmetic and clamps it to the destination buffer size before `memcpy`. ## Changes - `third_party/utf8_range/lemire-avx2.c` - `third_party/utf8_range/lemire-sse.c` - `third_party/utf8_range/main.c` - Convert `len` to `size_t` after rejecting negative values. - Use `src_len` consistently for loop and tail-length calculations. - Bound the final tail copy to the local buffer size: - 32 bytes in the AVX2 path. - 16 bytes in the SSE path. - Add a defensive allocation/copy check in the test helper. ## Security impact This should be treated as defensive hardening rather than a demonstrated critical vulnerability. The goal is to make the fixed-size tail-buffer invariant explicit and prevent future changes from accidentally turning the tail copy into an out-of-bounds write. ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] LLM code review passed --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* Closes #26797 COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/26797 from orbisai0security:fix-fix-v-001-memcpy-buffer-overflow-utf8-range 69f9c26476 PiperOrigin-RevId: 919700794		2026-05-22 08:58:02 -07:00
..
utf8_range	fix: Harden SIMD UTF-8 tail-copy bounds checks (#26797)	2026-05-22 08:58:02 -07:00
BUILD.bazel	Fix reference to jsoncpp.BUILD and zlib.BUILD. Colon was in wrong place, because there's a BUILD file in third_party.	2024-10-30 16:16:02 -07:00
jsoncpp.BUILD	Add Bazel9 test	2026-04-30 10:53:12 -07:00
zlib.BUILD	Move -Werror to our test/dev bazelrc files.	2024-08-23 13:26:32 -07:00