Skip to content

Fix infinite loop / OOM in proto reserved range parser#8966

Merged
jtdavis777 merged 2 commits into
google:masterfrom
dataCenter430:fix-proto-reserved-range-parser-infinite-loop
Mar 12, 2026
Merged

Fix infinite loop / OOM in proto reserved range parser#8966
jtdavis777 merged 2 commits into
google:masterfrom
dataCenter430:fix-proto-reserved-range-parser-infinite-loop

Conversation

@dataCenter430
Copy link
Copy Markdown
Contributor

Fixes: #8949

Summary

Fixes infinite loop and OOM when parsing proto reserved ranges that include the maximum field ID (65535). Addresses issue #8949.

Root cause

The loop in idl_parser.cpp (parsing e.g. reserved 0 to 65535) used voffset_t (uint16_t) as the loop counter. When id reached 65535, id++ wrapped to 0, so the condition id <= attribute remained true and the loop never exited, causing unbounded memory growth (CWE-835, CWE-400).

Fix

Use uint32_t for the loop counter so that after the last valid value (65535), id becomes 65536 and the loop terminates. Values are cast to voffset_t only when appending to reserved_ids.

@google-cla
Copy link
Copy Markdown

google-cla Bot commented Mar 10, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions github-actions Bot added c++ codegen Involving generating code from schema labels Mar 10, 2026
@dataCenter430
Copy link
Copy Markdown
Contributor Author

Hi, I'm a big fan of google and I'm going to contribute here actively, as a contributor.
This is my first PR, so I really hope this will be merged. Since each PR is so important for me. 🙏
Best regards

@jtdavis777 jtdavis777 merged commit fc9909c into google:master Mar 12, 2026
49 of 51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ codegen Involving generating code from schema

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Proto Reserved Range Parser Infinite Loop / OOM Denial of Service

2 participants