From 49ab6d5b81ef8d4eda0a79724bd1da0c93eaa7d7 Mon Sep 17 00:00:00 2001 From: payloadphreak <288649095+esoalba@users.noreply.github.com> Date: Wed, 9 Sep 2026 10:55:51 +0100 Subject: [PATCH 1/2] Verifier: size the size-prefixed identifier gate from the actual read window The identifier check in VerifyBufferFromStart guards the read with size_ >= 2 * sizeof(uoffset_t), which only covers the start == 0 layout. For size-prefixed 64-bit buffers (SizeT = uoffset64_t, start = 8) the identifier read sits at [12, 16); a 12-15 byte buffer passes the gate and BufferHasIdentifier reads up to 4 bytes past the end. Key the gate on the actual read window: size_ >= start + sizeof(uoffset_t) + kFileIdentifierLength. Behavior is unchanged for 32-bit paths and rejects before reading for the 64-bit size-prefixed shape. --- include/flatbuffers/verifier.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/include/flatbuffers/verifier.h b/include/flatbuffers/verifier.h index a0b793597c..44ec3e47ca 100644 --- a/include/flatbuffers/verifier.h +++ b/include/flatbuffers/verifier.h @@ -206,8 +206,14 @@ class VerifierTemplate FLATBUFFERS_FINAL_CLASS { // this call and their size is determined at runtime. if (!Check(size_ >= FLATBUFFERS_MIN_BUFFER_SIZE)) return false; - // If an identifier is provided, check that we have a buffer - if (identifier && !Check((size_ >= 2 * sizeof(flatbuffers::uoffset_t) && + // If an identifier is provided, check that we have a buffer large + // enough for the identifier read: [start + sizeof(uoffset_t), + // start + sizeof(uoffset_t) + kFileIdentifierLength). The previous + // 2 * sizeof(uoffset_t) form only covers start == 0 and lets the + // identifier scan run past the end of the buffer for size-prefix + // layouts with larger SizeT (e.g. uoffset64_t). + if (identifier && !Check((size_ >= start + sizeof(flatbuffers::uoffset_t) + + kFileIdentifierLength && BufferHasIdentifier(buf_ + start, identifier)))) { return false; } From e3b7caa4986d3514fed47ab2c78017e2f29b1fee Mon Sep 17 00:00:00 2001 From: payloadphreak <288649095+esoalba@users.noreply.github.com> Date: Thu, 10 Sep 2026 00:04:28 +0100 Subject: [PATCH 2/2] CLA: re-trigger cla/google check