[professor-moody]

Summary

The Verify() that flatc generates for a table skips deprecated fields (the field->deprecated check in src/idl_gen_cpp.cpp). That matches the schema docs: a deprecated field has no accessor, so nothing is supposed to read it. GenText() still walks every field in the schema, though, and for a deprecated field whose vtable slot is non-zero it reads the value and prints it. The vtable slot of a deprecated field is therefore never covered by a successful verification, and a buffer that passes VerifyMonsterBuffer() can still make GenText() read outside the buffer.

To see it with the stock monster_test.fbs, build a Monster with name and inventory set (52 bytes), then set the vtable entry of friendly (id 4, deprecated) to 28, which points one byte past the end. VerifyMonsterBuffer() returns true. Copying the buffer into an exact-size heap allocation and calling GenText() makes AddressSanitizer report a heap-buffer-overflow READ of size 1 in flatbuffers::ReadScalar<unsigned char>, reached through the JSON printer's GenField. In a Release build the byte after the buffer is printed as the value of friendly. The stock schema only has a deprecated bool, so I also tried a deprecated string. With a small schema that has a deprecated string field, a 28 byte buffer that passes the generated verifier made GenText() follow a crafted offset to memory after the buffer and print 64 bytes from there, with both the offset and the length taken from the file.

This change makes JsonPrinter skip deprecated fields. It does not make GenText() safe for buffers that were never verified (that is a separate problem); it removes the case where a buffer that did pass verification is still unsafe.

Behavior change to be aware of: a deprecated field that is present in the data, and fully in bounds, is no longer printed in the JSON output. The schema docs say old data may still contain such a field but "it won't be accessible anymore by newer code", so I read omitting it as consistent, but it is visible to anyone who relies on the old output. If you would rather keep printing deprecated fields (for example behind an option), I can rework it.

Test plan

Added GenTextValidBufferControlTest and GenTextCraftedDeprecatedSlotTest to tests/test.cpp. Both build the Monster above, check that VerifyMonsterBuffer() accepts it, and check that the GenText() output contains name but not friendly. The first leaves the buffer as built; the second sets the vtable entry of friendly to point at the first byte after the buffer. The buffer passed to the verifier sits in a vector with 8 readable bytes after the verified region, so the second test fails cleanly on the old code instead of faulting.

I built flattests with CMake and ran the whole binary with no filter, on Linux x86_64 with clang 22.1.8 at 5eb190f, once as a Release build and once with -O1 and the address and undefined behavior sanitizers. Both print ALL TESTS PASSED and the sanitizer build reports nothing. Without the src/idl_gen_text.cpp change the crafted test fails in both builds at its last assertion and the control test passes. Making the buffer exactly the verified size, with no trailing bytes, reproduces the AddressSanitizer report above on the old code and runs clean with the change.

A coverage build shows the new continue is taken 55 times by the existing tests, all of which still pass. clang-format with the repository style leaves both files unchanged.

AI assistance was used in drafting and validating this change; the patch and tests were reviewed and verified by the author.