Skip to content

Hardening: add null guards and bounds checks to minireflect, hash functions, and flathash - #9376

Open
anagnorisis2peripeteia wants to merge 1 commit into
google:masterfrom
anagnorisis2peripeteia:fix-minireflect-hash-and-flathash-safety
Open

anagnorisis2peripeteia wants to merge 1 commit into
google:masterfrom
anagnorisis2peripeteia:fix-minireflect-hash-and-flathash-safety

Conversation

@anagnorisis2peripeteia

Copy link
Copy Markdown

Summary

This PR hardens mini-reflection, hash computation, and the flathash tool against null pointer dereferences and integer underflow hazards:

  1. minireflect.h:

    • InlineSize: Guard against type_table == nullptr and validate type_table->values != nullptr before indexing struct sizes.
    • IterateValue: Guard against visitor == nullptr and val == nullptr, safely forwarding null/missing values to visitor->Unknown(val) instead of performing unaligned reads. Guard type_table == nullptr in ET_SEQUENCE.
    • IterateObject: Add early exit when obj, type_table, or visitor is nullptr.
    • IterateFlatBuffer: Guard !buffer || !type_table || !callback and check root != nullptr before invoking IterateObject.
    • ToStringVisitor: Guard indent_level > 0 before decrementing in EndSequence() and EndVector() to prevent unsigned integer underflow. Guard str == nullptr in String() to avoid dereferencing null string pointers.
    • FlatBufferToString: Return empty string "" immediately when buffer or type_table is nullptr.
  2. hash.h:

    • HashFnv1 & HashFnv1a: Guard !input and return 0 instead of immediately dereferencing *input.
    • FindHashFunction16, FindHashFunction32, FindHashFunction64: Guard !name before calling std::strcmp to prevent segmentation faults on null lookup keys.
  3. flathash.cpp:

    • Guard argc > 0 && argv[0] and argv[1] in argument parsing.
    • In command line argument iteration loop, guard arg != nullptr before inspecting prefix characters and passing to hash functions.
  4. Unit Tests:

    • Added MiniReflectHashSafetyTest() in tests/test.cpp verifying behavior with null buffers, null hash names, null strings in ToStringVisitor, and underflow resilience.
    • Verified clean compilation with -DFLATBUFFERS_STRICT_MODE=ON, flattests, and flatc_cpp_tests.py.

@github-actions github-actions Bot added c++ codegen Involving generating code from schema labels Oct 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ codegen Involving generating code from schema

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant