Skip to content

Commit

Permalink
upb: fix uninitialized upb_MessageValue buffer bugs
Browse files Browse the repository at this point in the history
Fixes protocolbuffers#18045

This should also cover googleapis/proto-plus-python#483 once we release it.

PiperOrigin-RevId: 671934556
  • Loading branch information
ericsalo authored and copybara-github committed Sep 7, 2024
1 parent b179075 commit 1321c26
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 3 deletions.
6 changes: 4 additions & 2 deletions upb/json/decode.c
Original file line number Diff line number Diff line change
Expand Up @@ -711,7 +711,8 @@ static upb_MessageValue jsondec_int(jsondec* d, const upb_FieldDef* f) {

/* Parse UINT32 or UINT64 value. */
static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
upb_MessageValue val = {0};
upb_MessageValue val;
memset(&val, 0, sizeof(val));

switch (jsondec_peek(d)) {
case JD_NUMBER: {
Expand Down Expand Up @@ -748,7 +749,8 @@ static upb_MessageValue jsondec_uint(jsondec* d, const upb_FieldDef* f) {
/* Parse DOUBLE or FLOAT value. */
static upb_MessageValue jsondec_double(jsondec* d, const upb_FieldDef* f) {
upb_StringView str;
upb_MessageValue val = {0};
upb_MessageValue val;
memset(&val, 0, sizeof(val));

switch (jsondec_peek(d)) {
case JD_NUMBER:
Expand Down
3 changes: 2 additions & 1 deletion upb/reflection/message.c
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,8 @@ bool upb_Message_Next(const upb_Message* msg, const upb_MessageDef* m,
const upb_MiniTable* mt = upb_MessageDef_MiniTable(m);
size_t i = *iter;
size_t n = upb_MiniTable_FieldCount(mt);
const upb_MessageValue zero = {0};
upb_MessageValue zero;
memset(&zero, 0, sizeof(zero));
UPB_UNUSED(ext_pool);

// Iterate over normal fields, returning the first one that is set.
Expand Down

0 comments on commit 1321c26

Please sign in to comment.