Skip to content

upb: reject repeated message extensions in GetOrPromoteExtension - #29291

Open
paulocsanz wants to merge 1 commit into
protocolbuffers:mainfrom
paulocsanz:pr-c003-promote-repeated
Open

upb: reject repeated message extensions in GetOrPromoteExtension#29291
paulocsanz wants to merge 1 commit into
protocolbuffers:mainfrom
paulocsanz:pr-c003-promote-repeated

Conversation

@paulocsanz

Copy link
Copy Markdown

upb_Message_GetOrPromoteExtension asserts CType == Message but does not check cardinality.

The function stores a upb_Message* in the extension slot. Repeated extensions are consumed as upb_Array* by the encoder and by GetExtensionMutableArray. Promoting a repeated message extension therefore confuses a message for an array.

This change returns kUpb_GetExtension_ParseError for non-scalar extensions. Repeated unknowns should go through upb_MiniTable_PromoteUnknownToMessageArray, which already exists and is covered by PromoteUnknownRepeatedMessageOld.

Singular message extensions are unchanged (existing promote_test cases plus a NotPresent control in the new test).

@google-cla

google-cla Bot commented Aug 20, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

GetOrPromoteExtension stores a upb_Message* in the extension slot.
Repeated extensions are consumed as upb_Array* (encoder, accessors),
so promoting a repeated message extension is a type confusion.

Fail with ParseError for non-scalar extensions. Repeated unknowns
should go through PromoteUnknownToMessageArray.

Signed-off-by: Paulo Cabral Sanz <ppaulo.sanz@gmail.com>
@paulocsanz
paulocsanz force-pushed the pr-c003-promote-repeated branch from 4e48fae to a8b43ef Compare August 20, 2026 03:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant