Fix clang undefined behavior sanitizer errors.

Signed and unsigned integer overflows, no actual consequences
but clean up the errors.

CHANGELOG.txt

@@ -11,6 +11,7 @@ nanopb-0.4.2 (2020-06-xx)
  Fix field descriptor sizing with submsg_callback option (#545)
  Fix protoc calling on Python 2 (#503)
  Fix handling of varying NaN representations in PB_CONVERT_DOUBLE_FLOAT (#543)
+ Fix clang undefined behavior sanitizer errors.
  Change generator to use Python 3 by default (#441, #509)
  Binary packages updated to use Python 3 and grpcio-tools
  Add support for infinity and nan floating-point defaults (#530, #538)
@@ -31,6 +32,8 @@ nanopb-0.4.2 (2020-06-xx)
  Swift package manager (#549)
  Rename BUILD as BUILD.bazel (#537)
 
+Note: Windows binary packages in 0.4.2 and later require Windows 7 or newer.
+
 nanopb-0.4.1 (2020-02-02)
  Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
  Avoid overflows in allocation for packed fields.
@@ -92,6 +95,12 @@ nanopb-0.4.0 (2019-12-20)
  CMake: Split nanopb_out command (#454)
  CMake: install created shared library(dll) in windows to the binary folder (#447)
 
+nanopb-0.3.9.6 (2020-06-23)
+ Fix buffer overflow when encoding bytes with size set to 65535 (#547, GHSA-3p39-mfxg-hrq4)
+ Fix proto3 submessage improperly considered empty (#504)
+ Fix ImportError when using generator/protoc with Python 3
+ Add build rules for Swift package manager (#549)
+
 nanopb-0.3.9.5 (2020-02-02)
  Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
  Add workaround for avr-libc realloc() bug (#475)
@@ -263,6 +272,10 @@ nanopb-0.3.0 (2014-08-26)
  Added #if version guard to generated files (issue 129)
  Added migration document
 
+nanopb-0.2.9.5 (2020-06-23)
+ Fix buffer overflow when encoding bytes with size set to 65535 (#547, GHSA-3p39-mfxg-hrq4)
+ Backport Python 3 and protoc 3.x fixes to test cases
+
 nanopb-0.2.9.4 (2020-02-02)
  Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
  Add workaround for avr-libc realloc() bug (#475)

pb_common.c

@@ -151,6 +151,11 @@ bool pb_field_iter_begin(pb_field_iter_t *iter, const pb_msgdesc_t *desc, void *
     iter->descriptor = desc;
     iter->message = message;
 
+    if (!desc || !message)
+    {
+        return false;
+    }
+
     return load_descriptor_values(iter);
 }
 

pb_decode.c

@@ -819,7 +819,7 @@ static bool checkreturn default_extension_decoder(pb_istream_t *stream,
     pb_field_iter_t iter;
 
     if (!pb_field_iter_begin_extension(&iter, extension))
-        PB_RETURN_ERROR(stream, "invalid extension");
+        return true; /* Empty field list or extension->dest is null for static fields */
 
     if (iter.tag != tag)
         return true;
@@ -1277,7 +1277,7 @@ static void pb_release_single_field(pb_field_iter_t *field)
         
         if (field->pData)
         {
-            while (count--)
+            for (; count > 0; count--)
             {
                 pb_release(field->submsg_desc, field->pData);
                 field->pData = (char*)field->pData + field->data_size;
@@ -1294,7 +1294,7 @@ static void pb_release_single_field(pb_field_iter_t *field)
             /* Release entries in repeated string or bytes array */
             void **pItem = *(void***)field->pField;
             pb_size_t count = *(pb_size_t*)field->pSize;
-            while (count--)
+            for (; count > 0; count--)
             {
                 pb_free(*pItem);
                 *pItem++ = NULL;

pb_encode.c

@@ -833,7 +833,6 @@ static bool checkreturn pb_enc_fixed(pb_ostream_t *stream, const pb_field_iter_t
 static bool checkreturn pb_enc_bytes(pb_ostream_t *stream, const pb_field_iter_t *field)
 {
     const pb_bytes_array_t *bytes = NULL;
-    size_t allocsize;
 
     bytes = (const pb_bytes_array_t*)field->pData;
     
@@ -843,9 +842,8 @@ static bool checkreturn pb_enc_bytes(pb_ostream_t *stream, const pb_field_iter_t
         return pb_encode_string(stream, NULL, 0);
     }
     
-    allocsize = PB_BYTES_ARRAY_T_ALLOCSIZE(bytes->size);
-    if (allocsize < bytes->size ||
-        (PB_ATYPE(field->type) == PB_ATYPE_STATIC && allocsize > field->data_size))
+    if ((size_t)bytes->size > ((size_t)-1) - offsetof(pb_bytes_array_t, bytes) ||
+        (PB_ATYPE(field->type) == PB_ATYPE_STATIC && PB_BYTES_ARRAY_T_ALLOCSIZE(bytes->size) > field->data_size))
     {
         PB_RETURN_ERROR(stream, "bytes size exceeded");
     }