Skip to content

Commit 7a71843

Browse files
l46kokcopybara-github
authored andcommitted
Fix truncated list indices in select-optimized field qualification.
PiperOrigin-RevId: 1002721090
1 parent 9e4b7a2 commit 7a71843

2 files changed

Lines changed: 20 additions & 2 deletions

File tree

‎extensions/protobuf/internal/qualify.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414

1515
#include "extensions/protobuf/internal/qualify.h"
1616

17+
#include <cstdint>
1718
#include <string>
1819
#include <utility>
1920

@@ -290,13 +291,13 @@ absl::StatusOr<int> ProtoQualifyState::CheckListIndex(
290291
cel::builtin::kIndex);
291292
}
292293

293-
int index = *qualifier.GetInt64Key();
294+
int64_t index = *qualifier.AsInt();
294295
int size = reflection_->FieldSize(*message_, repeated_field_desc_);
295296
if (index < 0 || index >= size) {
296297
return absl::InvalidArgumentError(
297298
absl::StrCat("index out of bounds: index=", index, " size=", size));
298299
}
299-
return index;
300+
return static_cast<int>(index);
300301
}
301302

302303
absl::Status ProtoQualifyState::ApplyAttributeQualifierList(

‎extensions/select_optimization_test.cc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1301,6 +1301,23 @@ INSTANTIATE_TEST_SUITE_P(
13011301
HasSubstr("index out of bounds")));
13021302
},
13031303
},
1304+
{
1305+
// -2^32, which would read element 0 if truncated to an int.
1306+
"select_with_repeated_index_beyond_int32",
1307+
"nested_test_all_types.payload.repeated_nested_message"
1308+
"[-4294967296].bb",
1309+
{{"nested_test_all_types",
1310+
R"pb(
1311+
payload { repeated_nested_message {} }
1312+
)pb"}},
1313+
ActivationSetupFn(),
1314+
[](const absl::StatusOr<Value>& got) {
1315+
ASSERT_OK_AND_ASSIGN(Value result, got);
1316+
ASSERT_TRUE(result->Is<ErrorValue>()) << result->DebugString();
1317+
EXPECT_THAT(result.GetError().NativeValue(),
1318+
StatusIs(absl::StatusCode::kInvalidArgument));
1319+
},
1320+
},
13041321
{
13051322
"unknown_field",
13061323
"((false)? a.child.child : b.child).child.payload.single_int64",

0 commit comments

Comments
 (0)