From a2485d4ecc52776a06eac95ddd69fe4b640a76a8 Mon Sep 17 00:00:00 2001 From: Mark Nauwelaerts Date: Mon, 19 Aug 2019 21:48:25 +0200 Subject: [PATCH] reflection: check for valid union enum value during object verification (#5475) ... to avoid assertion failure or invalid access due to invalid vector index --- src/reflection.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/reflection.cpp b/src/reflection.cpp index 89ce78385..5055959a6 100644 --- a/src/reflection.cpp +++ b/src/reflection.cpp @@ -656,6 +656,7 @@ bool VerifyObject(flatbuffers::Verifier &v, const reflection::Schema &schema, if (utype != 0) { // Means we have this union field present auto fb_enum = schema.enums()->Get(field_def->type()->index()); + if (utype >= fb_enum->values()->size()) return false; auto child_obj = fb_enum->values()->Get(utype)->object(); if (!VerifyObject(v, schema, *child_obj, flatbuffers::GetFieldT(*table, *field_def),