rust: fix 64-bit scalar wire-format alignment on 32-bit targets in Push::alignment (#9465)

In the FlatBuffers binary wire format specification, every scalar field is
aligned to its own byte size (`1`, `2`, `4`, or `8` bytes), regardless of the
host CPU architecture. Both the `flatc` schema compiler (when computing table
`max_align` and struct field offsets) and the C++ `FlatBufferBuilder::Align` /
`PushElement` implementation align 64-bit scalars (`u64`, `i64`, `f64`) to 8
bytes on all architectures.

However, in the Rust `flatbuffers` crate (`rust/flatbuffers/src/push.rs`), the
`Push` trait provides a default implementation:

```rust
fn alignment() -> PushAlignment {
    PushAlignment::new(align_of::<Self::Output>())
}
```

And `impl_push_for_endian_scalar!` did not override `Push::alignment()`,
inheriting `core::mem::align_of::<T>()` for all primitive scalar types (`bool`,
`u8`, `i8`, `u16`, `i16`, `u32`, `i32`, `u64`, `i64`, `f32`, `f64`).

On 64-bit targets (`x86_64`, `aarch64`) and 32-bit ARM (`armv7`),
`align_of::<u64>() == 8`, so `align_of::<T>()` happens to equal `size_of::<T>()`.
On 32-bit x86 (`i686`, System V i386 ABI), however, the host ABI alignment of
64-bit scalars (`u64`, `i64`, `f64`) is **4 bytes** (`align_of::<u64>() == 4`),
while their FlatBuffer wire-format size and required wire alignment is **8
bytes** (`size_of::<u64>() == 8`).

As a consequence, on 32-bit x86 (`i686`):
1. `FlatBufferBuilder::push::<u64 / i64 / f64>` only aligns the builder's cursor
   and tracks `min_align` to 4 bytes instead of 8 bytes when writing 64-bit
   table fields or vectors of 64-bit scalars.
2. When a table containing a 64-bit scalar field (`uint64`, `int64`, `double`)
   is serialized on `i686`, the field can be placed at a buffer offset that is
   4-byte aligned but not 8-byte aligned.
3. When the resulting FlatBuffer is verified by C++ `flatbuffers::Verifier`
   (which checks `VerifyField<uint64_t>` with `sizeof(uint64_t) == 8` alignment
   when `FLATBUFFERS_TRACK_VERIFIER_BUFFER_SIZE` / alignment checks are active)
   or transferred to a 64-bit reader, verification fails or unaligned 64-bit
   reads occur.

Fix `impl_push_for_endian_scalar!` to explicitly implement `Push::alignment()`
using `size_of::<$ty>()` so that all endian scalar types always use their
wire-format byte size as their FlatBuffer alignment across all target
architectures.

Package.swift

@@ -75,6 +75,17 @@ extension Array where Element == Package.Dependency {
       .package(
         url: "https://github.com/grpc/grpc-swift-nio-transport.git",
         from: "2.0.0"),
+      // swift-crypto arrives through grpc-swift-nio-transport -> swift-nio-ssl
+      // and is otherwise resolved afresh on every build, because this package
+      // ships no Package.resolved. 5.x asks for swift-tools-version 6.2, so only
+      // the 6.2 CI job selects it - and then fails to compile it, because 5.x
+      // uses `@nonexhaustive`, which the 6.2.x toolchains do not accept yet.
+      // Stay on the last 4.x release that still builds with every toolchain in
+      // the Swift CI matrix (4.3.0 declares swift-tools-version 6.0; 4.4+ asks
+      // for 6.1 and would drop the 6.0 job).
+      .package(
+        url: "https://github.com/apple/swift-crypto.git",
+        "4.0.0" ..< "4.4.0"),
     ]
     #endif
   }

include/flatbuffers/base.h

@@ -271,7 +271,7 @@ namespace flatbuffers {
   #if (defined(_MSC_VER) && _MSC_VER >= 1800) || \
       (defined(__ANDROID__) && defined(__ANDROID_API__) && __ANDROID_API__>= 26) || \
       (defined(_XOPEN_VERSION) && (_XOPEN_VERSION >= 700)) && \
-      !defined(__Fuchsia__)
+      !defined(__Fuchsia__) && (!defined(__linux__) || defined(__GLIBC__))
     #define FLATBUFFERS_LOCALE_INDEPENDENT 1
   #else
     #define FLATBUFFERS_LOCALE_INDEPENDENT 0

lobster/flatbuffers.lobster

@@ -24,15 +24,14 @@ class handle:
 struct offset:
     o:int
 
-enum sizeof:
-    sz_8 = 1
-    sz_16 = 2
-    sz_32 = 4
-    sz_64 = 8
-    sz_voffset = 2
-    sz_uoffset = 4
-    sz_soffset = 4
-    sz_metadata_fields = 2
+let sz_8 = 1
+let sz_16 = 2
+let sz_32 = 4
+let sz_64 = 8
+let sz_voffset = 2
+let sz_uoffset = 4
+let sz_soffset = 4
+let sz_metadata_fields = 2
 
 class builder:
     buf = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

rust/flatbuffers/src/push.rs

@@ -83,6 +83,11 @@ macro_rules! impl_push_for_endian_scalar {
             unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
                 emplace_scalar::<$ty>(dst, *self);
             }
+
+            #[inline]
+            fn alignment() -> PushAlignment {
+                PushAlignment::new(size_of::<$ty>())
+            }
         }
     };
 }
@@ -98,3 +103,23 @@ impl_push_for_endian_scalar!(u64);
 impl_push_for_endian_scalar!(i64);
 impl_push_for_endian_scalar!(f32);
 impl_push_for_endian_scalar!(f64);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn endian_scalar_push_alignment_matches_wire_size() {
+        assert_eq!(<bool as Push>::alignment().value(), 1);
+        assert_eq!(<u8 as Push>::alignment().value(), 1);
+        assert_eq!(<i8 as Push>::alignment().value(), 1);
+        assert_eq!(<u16 as Push>::alignment().value(), 2);
+        assert_eq!(<i16 as Push>::alignment().value(), 2);
+        assert_eq!(<u32 as Push>::alignment().value(), 4);
+        assert_eq!(<i32 as Push>::alignment().value(), 4);
+        assert_eq!(<f32 as Push>::alignment().value(), 4);
+        assert_eq!(<u64 as Push>::alignment().value(), 8);
+        assert_eq!(<i64 as Push>::alignment().value(), 8);
+        assert_eq!(<f64 as Push>::alignment().value(), 8);
+    }
+}

src/idl_gen_cpp.cpp

@@ -404,7 +404,7 @@ class CppGenerator : public BaseGenerator {
       code_ += "struct {{STRUCT_NAME}}BinarySchema {";
       code_ += "  static const uint8_t *data() {";
       code_ += "    // Buffer containing the binary schema.";
-      code_ += "    static const uint8_t bfbsData[" +
+      code_ += "    alignas(uint64_t) static const uint8_t bfbsData[" +
                NumToString(parser_.builder_.GetSize()) + "] = {";
       code_ += binary_schema_hex_text;
       code_ += "    };";

swift/Sources/FlatBuffers/Root.swift

@@ -16,6 +16,30 @@
 
 import Foundation
 
+@inline(__always)
+private func verifySizePrefix(
+  byteBuffer: inout ByteBuffer,
+  requireExactSize: Bool,
+  options: VerifierOptions) throws
+{
+  let verifier = try Verifier(buffer: &byteBuffer, options: options)
+  let prefixPosition = byteBuffer.reader
+  let prefix: UOffset = try verifier.getValue(at: prefixPosition)
+  let availableSize = byteBuffer.size &- UOffset(MemoryLayout<UOffset>.size)
+
+  if requireExactSize {
+    guard prefix == availableSize else {
+      throw FlatbuffersErrors.prefixedSizeNotEqualToBufferSize
+    }
+  } else if prefix > availableSize {
+    throw FlatbuffersErrors.outOfBounds(
+      position: UInt(prefixPosition)
+        &+ UInt(MemoryLayout<UOffset>.size)
+        &+ UInt(prefix),
+      end: byteBuffer.capacity)
+  }
+}
+
 /// Takes in a prefixed sized buffer, where the prefixed size would be skipped.
 /// And would verify that the buffer passed is a valid `Flatbuffers` Object.
 /// - Parameters:
@@ -31,6 +55,10 @@ public func getPrefixedSizeCheckedRoot<T: FlatBufferTable & Verifiable>(
   fileId: String? = nil,
   options: VerifierOptions = .init()) throws -> T
 {
+  try verifySizePrefix(
+    byteBuffer: &byteBuffer,
+    requireExactSize: false,
+    options: options)
   byteBuffer.skipPrefix()
   return try getCheckedRoot(
     byteBuffer: &byteBuffer,
@@ -53,10 +81,11 @@ public func getCheckedPrefixedSizeRoot<T: FlatBufferTable & Verifiable>(
   fileId: String? = nil,
   options: VerifierOptions = .init()) throws -> T
 {
-  let prefix = byteBuffer.skipPrefix()
-  if prefix != byteBuffer.size {
-    throw FlatbuffersErrors.prefixedSizeNotEqualToBufferSize
-  }
+  try verifySizePrefix(
+    byteBuffer: &byteBuffer,
+    requireExactSize: true,
+    options: options)
+  byteBuffer.skipPrefix()
   return try getCheckedRoot(
     byteBuffer: &byteBuffer,
     fileId: fileId,
@@ -95,14 +124,15 @@ public func getCheckedRoot<T: FlatBufferTable & Verifiable>(
   options: VerifierOptions = .init()) throws -> T
 {
   var verifier = try Verifier(buffer: &byteBuffer, options: options)
+  let rootPosition = byteBuffer.reader
   if let fileId = fileId {
-    try verifier.verify(id: fileId)
+    try verifier.verify(id: fileId, at: rootPosition)
   }
-  try ForwardOffset<T>.verify(&verifier, at: 0, of: T.self)
+  try ForwardOffset<T>.verify(&verifier, at: rootPosition, of: T.self)
   return T.init(
     byteBuffer,
-    o: Int32(byteBuffer.read(def: UOffset.self, position: byteBuffer.reader))
-      &+ Int32(byteBuffer.reader))
+    o: Int32(byteBuffer.read(def: UOffset.self, position: rootPosition))
+      &+ Int32(rootPosition))
 }
 
 /// Returns a `NON-Checked` flatbuffers object

swift/Sources/FlatBuffers/Verifier.swift

@@ -215,12 +215,16 @@ public struct Verifier {
   }
 
   @inline(__always)
-  func verify(id: String) throws {
+  func verify(id: String, at position: Int) throws {
     let size = MemoryLayout<Int32>.size
-    guard storage.capacity >= (size &* 2) else {
+    guard
+      position >= 0,
+      position <= storage.capacity,
+      storage.capacity - position >= size &* 2
+    else {
       throw FlatbuffersErrors.bufferDoesntContainID
     }
-    let str = _buffer.readString(at: size, count: size)
+    let str = _buffer.readString(at: position &+ size, count: size)
     if id == str {
       return
     }

tests/monster_test_bfbs_generated.h

@@ -12,7 +12,7 @@ namespace Example {
 struct MonsterBinarySchema {
   static const uint8_t *data() {
     // Buffer containing the binary schema.
-    static const uint8_t bfbsData[14520] = {
+    alignas(uint64_t) static const uint8_t bfbsData[14520] = {
       0x20,0x00,0x00,0x00,0x42,0x46,0x42,0x53,0x00,0x00,0x00,0x00,0x14,0x00,0x20,0x00,0x04,0x00,0x08,0x00,
       0x0C,0x00,0x10,0x00,0x14,0x00,0x18,0x00,0x00,0x00,0x1C,0x00,0x14,0x00,0x00,0x00,0x58,0x00,0x00,0x00,
       0x34,0x00,0x00,0x00,0x24,0x00,0x00,0x00,0x18,0x00,0x00,0x00,0x70,0x0D,0x00,0x00,0x08,0x00,0x00,0x00,

tests/swift/Tests/Flatbuffers/FlatbuffersVerifierTests.swift

@@ -373,6 +373,58 @@ final class FlatbuffersVerifierTests {
     }
   }
 
+  @Test
+  func testSizePrefixedVerifierUsesPostPrefixRoot() throws {
+    // The size prefix points to a valid empty decoy table at byte 44. The real
+    // root at byte 4 points to a truncated UInt64 vector that must be rejected.
+    let bytes: [UInt8] = [
+      44, 0, 0, 0,
+      16, 0, 0, 0,
+      6, 0, 8, 0, 4, 0,
+      0, 0, 0, 0, 0, 0,
+      12, 0, 0, 0,
+      8, 0, 0, 0, 0, 0, 0, 0,
+      2, 0, 0, 0, 65, 66,
+      0, 0,
+      4, 0, 4, 0,
+      4, 0, 0, 0,
+    ]
+
+    var strictBuffer = ByteBuffer(bytes: bytes)
+    #expect(throws: FlatbuffersErrors.self) {
+      try getCheckedPrefixedSizeRoot(
+        byteBuffer: &strictBuffer) as Swift_Tests_Vectors
+    }
+
+    var prefixedBuffer = ByteBuffer(bytes: bytes)
+    #expect(throws: FlatbuffersErrors.self) {
+      try getPrefixedSizeCheckedRoot(
+        byteBuffer: &prefixedBuffer) as Swift_Tests_Vectors
+    }
+
+    var builder = FlatBufferBuilder()
+    let movie = Movie.createMovie(&builder)
+    Movie.finish(&builder, end: movie, prefix: true)
+    var validBuffer = builder.sizedBuffer
+    let _: Movie = try getCheckedPrefixedSizeRoot(
+      byteBuffer: &validBuffer,
+      fileId: Movie.id)
+
+    var shortBuffer = ByteBuffer(bytes: [0, 0, 0, 0])
+    #expect(throws: FlatbuffersErrors.bufferDoesntContainID) {
+      try getCheckedRoot(
+        byteBuffer: &shortBuffer,
+        fileId: Movie.id) as Movie
+    }
+
+    var oversizedPrefix = ByteBuffer(bytes: [5, 0, 0, 0, 0, 0, 0, 0])
+    #expect(throws: FlatbuffersErrors.outOfBounds(position: 9, end: 8)) {
+      try getPrefixedSizeCheckedRoot(
+        byteBuffer: &oversizedPrefix) as Movie
+    }
+    #expect(oversizedPrefix.reader == 0)
+  }
+
   @Test
   func testFullVerifier() throws {
     _ =