Compare commits

...

2 Commits

Author SHA1 Message Date
Jakob Kordež
38df29380a [Dart] Fix namespace alias from union type (#9088)
* Fix namespace alias from union type

* Fix namespace alias from union type
2026-05-24 21:13:42 -04:00
Ali Sherif
1f438bd40f [Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE) (#9081) 2026-05-08 10:16:10 +02:00
3 changed files with 35 additions and 26 deletions

View File

@@ -654,34 +654,15 @@ class DartGenerator : public BaseGenerator {
std::string NamespaceAliasFromUnionType(Namespace* root_namespace,
const Type& type) {
const std::vector<std::string> qualified_name_parts =
type.struct_def->defined_namespace->components;
if (std::equal(root_namespace->components.begin(),
root_namespace->components.end(),
qualified_name_parts.begin())) {
const Namespace& type_namespace = *type.struct_def->defined_namespace;
if (root_namespace->components == type_namespace.components) {
return namer_.Type(*type.struct_def);
}
std::string ns;
for (auto it = qualified_name_parts.begin();
it != qualified_name_parts.end(); ++it) {
auto& part = *it;
for (size_t i = 0; i < part.length(); i++) {
if (i && !isdigit(part[i]) && part[i] == CharToUpper(part[i])) {
ns += "_";
ns += CharToLower(part[i]);
} else {
ns += CharToLower(part[i]);
}
}
if (it != qualified_name_parts.end() - 1) {
ns += "_";
}
}
return ns + "." + namer_.Type(*type.struct_def);
const std::string ns = namer_.Namespace(type_namespace);
return ns.empty()
? namer_.Type(*type.struct_def)
: ImportAliasName(ns) + "." + namer_.Type(*type.struct_def);
}
void GenImplementationGetters(

View File

@@ -56,8 +56,15 @@ extension Verifiable {
let len: UOffset = try verifier.getValue(at: position)
let intLen = Int(len)
let start = Int(clamping: (position &+ MemoryLayout<Int32>.size).magnitude)
let byteCount = intLen.multipliedReportingOverflow(
by: MemoryLayout<T>.size)
guard !byteCount.overflow else {
throw FlatbuffersErrors.outOfBounds(
position: UInt.max,
end: verifier.capacity)
}
try verifier.isAligned(position: start, type: type.self)
try verifier.rangeInBuffer(position: start, size: intLen)
try verifier.rangeInBuffer(position: start, size: byteCount.partialValue)
return (start, intLen)
}
}

View File

@@ -411,6 +411,27 @@ final class FlatbuffersVerifierTests {
}
}
@Test(.bug("https://github.com/google/flatbuffers/issues/9082"))
func testRejectsTruncatedScalarVector() {
// swiftformat:disable all
var byteBuffer = ByteBuffer(bytes: [
16, 0, 0, 0,
6, 0, 8, 0,
4, 0, 0, 0,
0, 0, 0, 0,
12, 0, 0, 0,
8, 0, 0, 0,
0, 0, 0, 0,
2, 0, 0, 0,
65, 66,
])
// swiftformat:enable all
#expect(throws: FlatbuffersErrors.self) {
try getCheckedRoot(byteBuffer: &byteBuffer) as Swift_Tests_Vectors
}
}
@Test
func testValidUnionBuffer() {
let string = "Awesome \\\\t\t\nstring!"