Skip to content

Fix vtable offset overflow when table contains >= 32,766 fields#9108

Open
deezsecc wants to merge 1 commit into
google:masterfrom
deezsecc:fix-vtable-offset-overflow
Open

Fix vtable offset overflow when table contains >= 32,766 fields#9108
deezsecc wants to merge 1 commit into
google:masterfrom
deezsecc:fix-vtable-offset-overflow

Conversation

@deezsecc
Copy link
Copy Markdown

Description

This PR fixes a critical validation gap in flatc (idl_parser.cpp) where computed vtable offsets could silently overflow and wrap around when a table defines 32,766 or more fields.

Details

  • The vtable offset calculation formula is fixed_fields (4) + id * sizeof(voffset_t) (2).
  • Since the offset is cast to voffset_t (uint16_t), once field_id reaches 32,766, the calculated offset reaches 65,536, which wraps to 0 and collides with the vtable vsize metadata slot. Field index 32,768 wraps to 4, colliding directly with VT_FIELD0 (offset 4).
  • This allows a malformed buffer to bypass verification because the C++ Verifier validates layout using one field type, while the application reads using another (causing type confusion and OOB reads).

Fixes

  • Auto-Incrementing Path (Parser::AddField): Added active validation returning a compiler error if the table fields count reaches 32,766 (which translates to a maximum offset of 65,534, the last value that safely fits in voffset_t).
  • Explicit IDs Path (Parser::ParseDecl): Replaced a release-stripped FLATBUFFERS_ASSERT with an active Error() return check.

@deezsecc deezsecc requested a review from dbaileychess as a code owner May 27, 2026 17:22
@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 27, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions github-actions Bot added python c++ codegen Involving generating code from schema swift labels May 27, 2026
@deezsecc deezsecc force-pushed the fix-vtable-offset-overflow branch from 5276063 to fa8d7c4 Compare May 27, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ codegen Involving generating code from schema python swift

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants