The previous check was prone to giving warnings on various platforms.
Also there is no real need to check for other than PB_ATYPE_STATIC, as
anyone passing a pointer variable is responsible for having correctly
allocated the array.
On platforms where size_t equals pb_size_t, for example AVR where both
are 16-bit, or x86 and ARM when PB_FIELD_32BIT is defined, the buffer size
checks in pb_write() and pb_enc_submessage can overflow if a bytes field
has size close to maximum size value. This causes read and write out of bounds.
This issue can cause a security vulnerability if the size of a bytes field
in the structure given to pb_encode() is untrusted. Note that pb_decode()
has correct bounds checking and will reject too large values.
If option proto3_singular_msgs was given and a proto3 submessage
contained a pointer field set to NULL, the encoder would crash with
null pointer dereference.
The validation function can be useful for user code also.
Also made the encoding check validity also, because it's
better to catch invalid messages in the transmitting end.
Added unittests for the validation.
Removed PB_OLD_CALLBACK_STYLE. Added generator option
submsg_callback to have a message-level callback for
setting up callbacks inside oneofs. Added example/testcase
about using callbacks with oneofs.
Previously nanopb didn't enforce that decoded bool fields
had valid true/false values. This could lead to undefined
behavior in user code.
This has potential security implications when
1) message contains bool field (has_ fields are safe)
and
2) user code uses ternary operator dependent on the field value,
such as: int value = msg.my_bool ? 1234 : 0
and
3) the value returned from ternary operator affects a memory access,
such as: data_array[value] = 9999
Don't encode scalar arrays as packed. This is only to be used when
the decoder on the receiving side cannot process packed scalar arrays.
Such example is older protobuf.js.
This could happen with zero-length submessages and strings.
While technically valid, it is an useless call and a rare
corner case that can easily lead to bugs in the callback
implementation.
This should simplify specifying combinations, so that we don't
need every variant of pb_decode_noinit_delimited() etc.
Also disables zero-terminated decoding in pb_decode (issue #278).
This seems like it will result in less boilerplate in typical situations
where a specific message is either decoded or encoded. Otherwise it would
result in lots of dummy functions like:
bool MyQuery_encode_callback(...)
{
return false; /* MyQuery is never encoded */
}
Now field information is stored as a variable-length uint32_t array.
This reduces the minimum size in most cases:
old new
basic field: 10 bytes 4 bytes
repeated field: 10 bytes 8 bytes
field with 12bit tag/size: 16 bytes 8 bytes
field with 16bit tag/size: 16 bytes 16 bytes
field with 32bit tag/size: 28 bytes 16 bytes
Further, now the descriptor size can be increased per-field and per-message,
instead of previous global PB_FIELD_16BIT and PB_FIELD_32BIT.
PB_FIELD_32BIT still affects the pb_size_t type, which is 16-bit by default.
Allow the elements of that single non-packed repeated fixed count field
to be interleaved among other (non-packed repeated fixed count) fields.
Multiple non-packed repeated fixed count fields are allowed if the
elements are not interleaved.
An error is returned if the count of a repeated fixed count field is not
equal the expected count.
Nanopb has traditionally supported messages to be terminated with a zero tag.
However, this is not really standard protobuf behaviour, so it makes sense
to separate it into a different function. Because it is a breaking change,
it will happen in 0.4.0 release. But I add the functions here early so that
new code can start using them now.
Also changed the network_server example to use en/decode_delimited(), which
is the more common protobuf method of simple message framing.
pb_check_proto3_default_value() recurses into submessages,
but it didn't handle other than singular fields correctly.
This caused it to sometimes skip submessages with only
repeated or oneof fields present.
Thought I was cleaning up the naming by calling the function const_cast(),
because that's what it does. But of course it conflicts with the C++ builtin,
so renaming it to pb_const_cast() now.
Adds support for proto3 and POINTER field types to have
fixed length bytes arrays. Also changed the .proto option
to a separate fixed_length:true, while also supporting the old FT_INLINE
option.
Restructured the generator and decoder logic to threat the inline
bytes fields more like "just another field type".
Changed to use simple indexing instead of while (count--) in buf_read()/buf_write(),
because the count overflowed from 0 to max on the last iteration. While the unsigned
integer overflow is defined and behaviour was correct, making this simple change
allowed enabling the sanitizer which might catch true errors elsewhere in the code.
If the type is string, do not try to deference it as int16, int32 or int64.
This may lead to unalign memory access, which may cause trap on some architectures (ARM)
Petteri Aimonen