[elnadym165]

Summary

Harden the C++ verifier against overflow when calculating the serialized size of a vector with a 64-bit length prefix.

VerifierTemplate::VerifyVectorOrString() currently checks the element count against max_size / elem_size, then calculates:

const auto byte_size = sizeof(LenT) + elem_size * size;

The element-count check does not account for the serialized length prefix. With an explicitly configured max_size sufficiently close to SIZE_MAX, a forged 64-bit element count can cause the addition to wrap, allowing a malformed vector to pass verification.

Fix

Calculate the maximum safely representable element count after reserving space for sizeof(LenT), and reject larger counts before computing byte_size.

The existing configured element-count limit is preserved.

Regression coverage

Add a test using the existing generated RootTable.big_vector schema. The test checks:

• Valid vectors remain accepted.
• Forged 64-bit vector lengths are rejected.
• Default verifier maximum size.
• Documented 64-bit maximum size.
• Explicit SIZE_MAX verifier configuration.
• Both Verifier and SizeVerifier.

The regression is executed from the existing 64-bit C++ test suite.

Validation

• GCC: complete flattests C++ test suite passed.
• Clang: complete flattests C++ test suite passed with AddressSanitizer and UndefinedBehaviorSanitizer.
• Independent vector-length boundary testing: 12,570 cases per compiler; the hardened implementation produced zero oracle mismatches.

Security and configuration notes

The demonstrated malformed input requires an unusually high, explicitly configured verifier max_size near SIZE_MAX. The default verifier configuration and documented 64-bit maximum reject the tested input.

Under the affected configuration, a malformed vector can pass generated-schema verification and a later accessor read can go out of bounds. No remote exploit or affected deployed application is claimed.

This contribution was coordinated with the Google Bug Hunter Team, which authorized submission as a standard upstream pull request.