WIRETYPE_REFERENCE has bug while handleUnknownField called

60 views
Skip to first unread message

Guo Zou

unread,
Jan 22, 2022, 4:39:50 AM1/22/22
to protostuff
Method: io.protostuff.runtime.RuntimeSchema#mergeFrom, if Desers didn't have the field, it will call input.handleUnknownField(n, this);
Instead of call field.mergeFrom(input, message);
    Inner this function, it will call: io.protostuff.GraphByteArrayInput#mergeObject
        it will call references.add(value);

The bug is if Desers didn't have some fields, the references will miss something and its sequence is no the same with Sers, so the later WIRETYPE_REFERENCE field will have a wrong ref. 

This bug may causes JVM crash, or data corruption.
Reply all
Reply to author
Forward
0 new messages