[vivek7424]

Summary

With a reuse tracker, flexbuffers::VerifyBuffer marks a vector as verified before it checks that vector's elements. An element that refers back to the vector finds the mark and is accepted, so a cyclic vector verifies. A consumer that walks the data recursively, such as Reference::ToString (used by flatc --json --flexbuffers), then recurses without bound and overflows the stack.

This PR marks the vector as in progress while its elements are checked. An element that reaches an in-progress vector fails verification. Shared, non-cyclic vectors still short-circuit as before.

Reproduction

The 31-byte input from #9074:

76 65 63 65 46 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 62 6f 6f 6c 73 00 04 01 00 28 01

Before this change:

• VerifyBuffer with a reuse tracker returns true. Walking the first element reaches depth 300 on a 31-byte buffer, which is only possible through a cycle.
• VerifyBuffer without a tracker returns false.
• flatc --json --flexbuffers on this file segfaults, with ToString and AppendToString<Vector> repeating in the backtrace.

After this change, all three reject the input.

Tests

FlexBuffersCycleRejectedTest checks that these bytes fail to verify with and without a tracker. The unpatched tree fails this test at flexbuffers_test.cpp:330. With this change, the full flattests suite passes.

Notes

• Relates to Unbounded Recursion / Stack Overflow in flexbuffers::Reference::ToString via Nested Vectors #9074. That issue describes the input as non-cyclic and reports about 245 frames. Our walk of the same bytes shows a cycle, and we did not measure the frame count.
• Overlaps the open refactor in flexbuffers: migrate Verifier internals to flatbuffers::span #9284 (span migration of the same Verifier internals). The change is small and can be rebased onto it.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.