1 /* pb_decode.c -- decode a protobuf using minimal resources
2 *
3 * 2011 Petteri Aimonen <jpa@kapsi.fi>
4 */
5
6 /* Use the GCC warn_unused_result attribute to check that all return values
7 * are propagated correctly. On other compilers and gcc before 3.4.0 just
8 * ignore the annotation.
9 */
10 #if !defined(__GNUC__) || ( __GNUC__ < 3) || (__GNUC__ == 3 && __GNUC_MINOR__ < 4)
11 #define checkreturn
12 #else
13 #define checkreturn __attribute__((warn_unused_result))
14 #endif
15
16 #include "pb.h"
17 #include "pb_decode.h"
18 #include "pb_common.h"
19
20 /**************************************
21 * Declarations internal to this file *
22 **************************************/
23
24 static bool checkreturn buf_read(pb_istream_t *stream, pb_byte_t *buf, size_t count);
25 static bool checkreturn pb_decode_varint32_eof(pb_istream_t *stream, uint32_t *dest, bool *eof);
26 static bool checkreturn read_raw_value(pb_istream_t *stream, pb_wire_type_t wire_type, pb_byte_t *buf, size_t *size);
27 static bool checkreturn decode_basic_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
28 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
29 static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
30 static bool checkreturn decode_callback_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
31 static bool checkreturn decode_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
32 static bool checkreturn default_extension_decoder(pb_istream_t *stream, pb_extension_t *extension, uint32_t tag, pb_wire_type_t wire_type);
33 static bool checkreturn decode_extension(pb_istream_t *stream, uint32_t tag, pb_wire_type_t wire_type, pb_extension_t *extension);
34 static bool pb_field_set_to_default(pb_field_iter_t *field);
35 static bool pb_message_set_to_defaults(pb_field_iter_t *iter);
36 static bool checkreturn pb_dec_bool(pb_istream_t *stream, const pb_field_iter_t *field);
37 static bool checkreturn pb_dec_varint(pb_istream_t *stream, const pb_field_iter_t *field);
38 static bool checkreturn pb_dec_bytes(pb_istream_t *stream, const pb_field_iter_t *field);
39 static bool checkreturn pb_dec_string(pb_istream_t *stream, const pb_field_iter_t *field);
40 static bool checkreturn pb_dec_submessage(pb_istream_t *stream, const pb_field_iter_t *field);
41 static bool checkreturn pb_dec_fixed_length_bytes(pb_istream_t *stream, const pb_field_iter_t *field);
42 static bool checkreturn pb_skip_varint(pb_istream_t *stream);
43 static bool checkreturn pb_skip_string(pb_istream_t *stream);
44
45 #ifdef PB_ENABLE_MALLOC
46 static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t data_size, size_t array_size);
47 static void initialize_pointer_field(void *pItem, pb_field_iter_t *field);
48 static bool checkreturn pb_release_union_field(pb_istream_t *stream, pb_field_iter_t *field);
49 static void pb_release_single_field(pb_field_iter_t *field);
50 #endif
51
52 #ifdef PB_WITHOUT_64BIT
53 #define pb_int64_t int32_t
54 #define pb_uint64_t uint32_t
55 #else
56 #define pb_int64_t int64_t
57 #define pb_uint64_t uint64_t
58 #endif
59
60 #define PB_WT_PACKED ((pb_wire_type_t)0xFF)
61
62 typedef struct {
63 uint32_t bitfield[(PB_MAX_REQUIRED_FIELDS + 31) / 32];
64 } pb_fields_seen_t;
65
66 /*******************************
67 * pb_istream_t implementation *
68 *******************************/
69
buf_read(pb_istream_t * stream,pb_byte_t * buf,size_t count)70 static bool checkreturn buf_read(pb_istream_t *stream, pb_byte_t *buf, size_t count)
71 {
72 size_t i;
73 const pb_byte_t *source = (const pb_byte_t*)stream->state;
74 stream->state = (pb_byte_t*)stream->state + count;
75
76 if (buf != NULL)
77 {
78 for (i = 0; i < count; i++)
79 buf[i] = source[i];
80 }
81
82 return true;
83 }
84
pb_read(pb_istream_t * stream,pb_byte_t * buf,size_t count)85 bool checkreturn pb_read(pb_istream_t *stream, pb_byte_t *buf, size_t count)
86 {
87 if (count == 0)
88 return true;
89
90 #ifndef PB_BUFFER_ONLY
91 if (buf == NULL && stream->callback != buf_read)
92 {
93 /* Skip input bytes */
94 pb_byte_t tmp[16];
95 while (count > 16)
96 {
97 if (!pb_read(stream, tmp, 16))
98 return false;
99
100 count -= 16;
101 }
102
103 return pb_read(stream, tmp, count);
104 }
105 #endif
106
107 if (stream->bytes_left < count)
108 PB_RETURN_ERROR(stream, "end-of-stream");
109
110 #ifndef PB_BUFFER_ONLY
111 if (!stream->callback(stream, buf, count))
112 PB_RETURN_ERROR(stream, "io error");
113 #else
114 if (!buf_read(stream, buf, count))
115 return false;
116 #endif
117
118 stream->bytes_left -= count;
119 return true;
120 }
121
122 /* Read a single byte from input stream. buf may not be NULL.
123 * This is an optimization for the varint decoding. */
pb_readbyte(pb_istream_t * stream,pb_byte_t * buf)124 static bool checkreturn pb_readbyte(pb_istream_t *stream, pb_byte_t *buf)
125 {
126 if (stream->bytes_left == 0)
127 PB_RETURN_ERROR(stream, "end-of-stream");
128
129 #ifndef PB_BUFFER_ONLY
130 if (!stream->callback(stream, buf, 1))
131 PB_RETURN_ERROR(stream, "io error");
132 #else
133 *buf = *(const pb_byte_t*)stream->state;
134 stream->state = (pb_byte_t*)stream->state + 1;
135 #endif
136
137 stream->bytes_left--;
138
139 return true;
140 }
141
pb_istream_from_buffer(const pb_byte_t * buf,size_t msglen)142 pb_istream_t pb_istream_from_buffer(const pb_byte_t *buf, size_t msglen)
143 {
144 pb_istream_t stream;
145 /* Cast away the const from buf without a compiler error. We are
146 * careful to use it only in a const manner in the callbacks.
147 */
148 union {
149 void *state;
150 const void *c_state;
151 } state;
152 #ifdef PB_BUFFER_ONLY
153 stream.callback = NULL;
154 #else
155 stream.callback = &buf_read;
156 #endif
157 state.c_state = buf;
158 stream.state = state.state;
159 stream.bytes_left = msglen;
160 #ifndef PB_NO_ERRMSG
161 stream.errmsg = NULL;
162 #endif
163 return stream;
164 }
165
166 /********************
167 * Helper functions *
168 ********************/
169
pb_decode_varint32_eof(pb_istream_t * stream,uint32_t * dest,bool * eof)170 static bool checkreturn pb_decode_varint32_eof(pb_istream_t *stream, uint32_t *dest, bool *eof)
171 {
172 pb_byte_t byte;
173 uint32_t result;
174
175 if (!pb_readbyte(stream, &byte))
176 {
177 if (stream->bytes_left == 0)
178 {
179 if (eof)
180 {
181 *eof = true;
182 }
183 }
184
185 return false;
186 }
187
188 if ((byte & 0x80) == 0)
189 {
190 /* Quick case, 1 byte value */
191 result = byte;
192 }
193 else
194 {
195 /* Multibyte case */
196 uint_fast8_t bitpos = 7;
197 result = byte & 0x7F;
198
199 do
200 {
201 if (!pb_readbyte(stream, &byte))
202 return false;
203
204 if (bitpos >= 32)
205 {
206 /* Note: The varint could have trailing 0x80 bytes, or 0xFF for negative. */
207 pb_byte_t sign_extension = (bitpos < 63) ? 0xFF : 0x01;
208 bool valid_extension = ((byte & 0x7F) == 0x00 ||
209 ((result >> 31) != 0 && byte == sign_extension));
210
211 if (bitpos >= 64 || !valid_extension)
212 {
213 PB_RETURN_ERROR(stream, "varint overflow");
214 }
215 }
216 else
217 {
218 result |= (uint32_t)(byte & 0x7F) << bitpos;
219 }
220 bitpos = (uint_fast8_t)(bitpos + 7);
221 } while (byte & 0x80);
222
223 if (bitpos == 35 && (byte & 0x70) != 0)
224 {
225 /* The last byte was at bitpos=28, so only bottom 4 bits fit. */
226 PB_RETURN_ERROR(stream, "varint overflow");
227 }
228 }
229
230 *dest = result;
231 return true;
232 }
233
pb_decode_varint32(pb_istream_t * stream,uint32_t * dest)234 bool checkreturn pb_decode_varint32(pb_istream_t *stream, uint32_t *dest)
235 {
236 return pb_decode_varint32_eof(stream, dest, NULL);
237 }
238
239 #ifndef PB_WITHOUT_64BIT
pb_decode_varint(pb_istream_t * stream,uint64_t * dest)240 bool checkreturn pb_decode_varint(pb_istream_t *stream, uint64_t *dest)
241 {
242 pb_byte_t byte;
243 uint_fast8_t bitpos = 0;
244 uint64_t result = 0;
245
246 do
247 {
248 if (bitpos >= 64)
249 PB_RETURN_ERROR(stream, "varint overflow");
250
251 if (!pb_readbyte(stream, &byte))
252 return false;
253
254 result |= (uint64_t)(byte & 0x7F) << bitpos;
255 bitpos = (uint_fast8_t)(bitpos + 7);
256 } while (byte & 0x80);
257
258 *dest = result;
259 return true;
260 }
261 #endif
262
pb_skip_varint(pb_istream_t * stream)263 bool checkreturn pb_skip_varint(pb_istream_t *stream)
264 {
265 pb_byte_t byte;
266 do
267 {
268 if (!pb_read(stream, &byte, 1))
269 return false;
270 } while (byte & 0x80);
271 return true;
272 }
273
pb_skip_string(pb_istream_t * stream)274 bool checkreturn pb_skip_string(pb_istream_t *stream)
275 {
276 uint32_t length;
277 if (!pb_decode_varint32(stream, &length))
278 return false;
279
280 if ((size_t)length != length)
281 {
282 PB_RETURN_ERROR(stream, "size too large");
283 }
284
285 return pb_read(stream, NULL, (size_t)length);
286 }
287
pb_decode_tag(pb_istream_t * stream,pb_wire_type_t * wire_type,uint32_t * tag,bool * eof)288 bool checkreturn pb_decode_tag(pb_istream_t *stream, pb_wire_type_t *wire_type, uint32_t *tag, bool *eof)
289 {
290 uint32_t temp;
291 *eof = false;
292 *wire_type = (pb_wire_type_t) 0;
293 *tag = 0;
294
295 if (!pb_decode_varint32_eof(stream, &temp, eof))
296 {
297 return false;
298 }
299
300 *tag = temp >> 3;
301 *wire_type = (pb_wire_type_t)(temp & 7);
302 return true;
303 }
304
pb_skip_field(pb_istream_t * stream,pb_wire_type_t wire_type)305 bool checkreturn pb_skip_field(pb_istream_t *stream, pb_wire_type_t wire_type)
306 {
307 switch (wire_type)
308 {
309 case PB_WT_VARINT: return pb_skip_varint(stream);
310 case PB_WT_64BIT: return pb_read(stream, NULL, 8);
311 case PB_WT_STRING: return pb_skip_string(stream);
312 case PB_WT_32BIT: return pb_read(stream, NULL, 4);
313 default: PB_RETURN_ERROR(stream, "invalid wire_type");
314 }
315 }
316
317 /* Read a raw value to buffer, for the purpose of passing it to callback as
318 * a substream. Size is maximum size on call, and actual size on return.
319 */
read_raw_value(pb_istream_t * stream,pb_wire_type_t wire_type,pb_byte_t * buf,size_t * size)320 static bool checkreturn read_raw_value(pb_istream_t *stream, pb_wire_type_t wire_type, pb_byte_t *buf, size_t *size)
321 {
322 size_t max_size = *size;
323 switch (wire_type)
324 {
325 case PB_WT_VARINT:
326 *size = 0;
327 do
328 {
329 (*size)++;
330 if (*size > max_size)
331 PB_RETURN_ERROR(stream, "varint overflow");
332
333 if (!pb_read(stream, buf, 1))
334 return false;
335 } while (*buf++ & 0x80);
336 return true;
337
338 case PB_WT_64BIT:
339 *size = 8;
340 return pb_read(stream, buf, 8);
341
342 case PB_WT_32BIT:
343 *size = 4;
344 return pb_read(stream, buf, 4);
345
346 case PB_WT_STRING:
347 /* Calling read_raw_value with a PB_WT_STRING is an error.
348 * Explicitly handle this case and fallthrough to default to avoid
349 * compiler warnings.
350 */
351
352 default: PB_RETURN_ERROR(stream, "invalid wire_type");
353 }
354 }
355
356 /* Decode string length from stream and return a substream with limited length.
357 * Remember to close the substream using pb_close_string_substream().
358 */
pb_make_string_substream(pb_istream_t * stream,pb_istream_t * substream)359 bool checkreturn pb_make_string_substream(pb_istream_t *stream, pb_istream_t *substream)
360 {
361 uint32_t size;
362 if (!pb_decode_varint32(stream, &size))
363 return false;
364
365 *substream = *stream;
366 if (substream->bytes_left < size)
367 PB_RETURN_ERROR(stream, "parent stream too short");
368
369 substream->bytes_left = (size_t)size;
370 stream->bytes_left -= (size_t)size;
371 return true;
372 }
373
pb_close_string_substream(pb_istream_t * stream,pb_istream_t * substream)374 bool checkreturn pb_close_string_substream(pb_istream_t *stream, pb_istream_t *substream)
375 {
376 if (substream->bytes_left) {
377 if (!pb_read(substream, NULL, substream->bytes_left))
378 return false;
379 }
380
381 stream->state = substream->state;
382
383 #ifndef PB_NO_ERRMSG
384 stream->errmsg = substream->errmsg;
385 #endif
386 return true;
387 }
388
389 /*************************
390 * Decode a single field *
391 *************************/
392
decode_basic_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)393 static bool checkreturn decode_basic_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
394 {
395 switch (PB_LTYPE(field->type))
396 {
397 case PB_LTYPE_BOOL:
398 if (wire_type != PB_WT_VARINT && wire_type != PB_WT_PACKED)
399 PB_RETURN_ERROR(stream, "wrong wire type");
400
401 return pb_dec_bool(stream, field);
402
403 case PB_LTYPE_VARINT:
404 case PB_LTYPE_UVARINT:
405 case PB_LTYPE_SVARINT:
406 if (wire_type != PB_WT_VARINT && wire_type != PB_WT_PACKED)
407 PB_RETURN_ERROR(stream, "wrong wire type");
408
409 return pb_dec_varint(stream, field);
410
411 case PB_LTYPE_FIXED32:
412 if (wire_type != PB_WT_32BIT && wire_type != PB_WT_PACKED)
413 PB_RETURN_ERROR(stream, "wrong wire type");
414
415 return pb_decode_fixed32(stream, field->pData);
416
417 case PB_LTYPE_FIXED64:
418 if (wire_type != PB_WT_64BIT && wire_type != PB_WT_PACKED)
419 PB_RETURN_ERROR(stream, "wrong wire type");
420
421 #ifdef PB_CONVERT_DOUBLE_FLOAT
422 if (field->data_size == sizeof(float))
423 {
424 return pb_decode_double_as_float(stream, (float*)field->pData);
425 }
426 #endif
427
428 #ifdef PB_WITHOUT_64BIT
429 PB_RETURN_ERROR(stream, "invalid data_size");
430 #else
431 return pb_decode_fixed64(stream, field->pData);
432 #endif
433
434 case PB_LTYPE_BYTES:
435 if (wire_type != PB_WT_STRING)
436 PB_RETURN_ERROR(stream, "wrong wire type");
437
438 return pb_dec_bytes(stream, field);
439
440 case PB_LTYPE_STRING:
441 if (wire_type != PB_WT_STRING)
442 PB_RETURN_ERROR(stream, "wrong wire type");
443
444 return pb_dec_string(stream, field);
445
446 case PB_LTYPE_SUBMESSAGE:
447 case PB_LTYPE_SUBMSG_W_CB:
448 if (wire_type != PB_WT_STRING)
449 PB_RETURN_ERROR(stream, "wrong wire type");
450
451 return pb_dec_submessage(stream, field);
452
453 case PB_LTYPE_FIXED_LENGTH_BYTES:
454 if (wire_type != PB_WT_STRING)
455 PB_RETURN_ERROR(stream, "wrong wire type");
456
457 return pb_dec_fixed_length_bytes(stream, field);
458
459 default:
460 PB_RETURN_ERROR(stream, "invalid field type");
461 }
462 }
463
decode_static_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)464 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
465 {
466 switch (PB_HTYPE(field->type))
467 {
468 case PB_HTYPE_REQUIRED:
469 return decode_basic_field(stream, wire_type, field);
470
471 case PB_HTYPE_OPTIONAL:
472 if (field->pSize != NULL)
473 *(bool*)field->pSize = true;
474 return decode_basic_field(stream, wire_type, field);
475
476 case PB_HTYPE_REPEATED:
477 if (wire_type == PB_WT_STRING
478 && PB_LTYPE(field->type) <= PB_LTYPE_LAST_PACKABLE)
479 {
480 /* Packed array */
481 bool status = true;
482 pb_istream_t substream;
483 pb_size_t *size = (pb_size_t*)field->pSize;
484 field->pData = (char*)field->pField + field->data_size * (*size);
485
486 if (!pb_make_string_substream(stream, &substream))
487 return false;
488
489 while (substream.bytes_left > 0 && *size < field->array_size)
490 {
491 if (!decode_basic_field(&substream, PB_WT_PACKED, field))
492 {
493 status = false;
494 break;
495 }
496 (*size)++;
497 field->pData = (char*)field->pData + field->data_size;
498 }
499
500 if (substream.bytes_left != 0)
501 PB_RETURN_ERROR(stream, "array overflow");
502 if (!pb_close_string_substream(stream, &substream))
503 return false;
504
505 return status;
506 }
507 else
508 {
509 /* Repeated field */
510 pb_size_t *size = (pb_size_t*)field->pSize;
511 field->pData = (char*)field->pField + field->data_size * (*size);
512
513 if ((*size)++ >= field->array_size)
514 PB_RETURN_ERROR(stream, "array overflow");
515
516 return decode_basic_field(stream, wire_type, field);
517 }
518
519 case PB_HTYPE_ONEOF:
520 if (PB_LTYPE_IS_SUBMSG(field->type) &&
521 *(pb_size_t*)field->pSize != field->tag)
522 {
523 /* We memset to zero so that any callbacks are set to NULL.
524 * This is because the callbacks might otherwise have values
525 * from some other union field.
526 * If callbacks are needed inside oneof field, use .proto
527 * option submsg_callback to have a separate callback function
528 * that can set the fields before submessage is decoded.
529 * pb_dec_submessage() will set any default values. */
530 memset(field->pData, 0, (size_t)field->data_size);
531
532 /* Set default values for the submessage fields. */
533 if (field->submsg_desc->default_value != NULL ||
534 field->submsg_desc->field_callback != NULL ||
535 field->submsg_desc->submsg_info[0] != NULL)
536 {
537 pb_field_iter_t submsg_iter;
538 if (pb_field_iter_begin(&submsg_iter, field->submsg_desc, field->pData))
539 {
540 if (!pb_message_set_to_defaults(&submsg_iter))
541 PB_RETURN_ERROR(stream, "failed to set defaults");
542 }
543 }
544 }
545 *(pb_size_t*)field->pSize = field->tag;
546
547 return decode_basic_field(stream, wire_type, field);
548
549 default:
550 PB_RETURN_ERROR(stream, "invalid field type");
551 }
552 }
553
554 #ifdef PB_ENABLE_MALLOC
555 /* Allocate storage for the field and store the pointer at iter->pData.
556 * array_size is the number of entries to reserve in an array.
557 * Zero size is not allowed, use pb_free() for releasing.
558 */
allocate_field(pb_istream_t * stream,void * pData,size_t data_size,size_t array_size)559 static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t data_size, size_t array_size)
560 {
561 void *ptr = *(void**)pData;
562
563 if (data_size == 0 || array_size == 0)
564 PB_RETURN_ERROR(stream, "invalid size");
565
566 #ifdef __AVR__
567 /* Workaround for AVR libc bug 53284: http://savannah.nongnu.org/bugs/?53284
568 * Realloc to size of 1 byte can cause corruption of the malloc structures.
569 */
570 if (data_size == 1 && array_size == 1)
571 {
572 data_size = 2;
573 }
574 #endif
575
576 /* Check for multiplication overflows.
577 * This code avoids the costly division if the sizes are small enough.
578 * Multiplication is safe as long as only half of bits are set
579 * in either multiplicand.
580 */
581 {
582 const size_t check_limit = (size_t)1 << (sizeof(size_t) * 4);
583 if (data_size >= check_limit || array_size >= check_limit)
584 {
585 const size_t size_max = (size_t)-1;
586 if (size_max / array_size < data_size)
587 {
588 PB_RETURN_ERROR(stream, "size too large");
589 }
590 }
591 }
592
593 /* Allocate new or expand previous allocation */
594 /* Note: on failure the old pointer will remain in the structure,
595 * the message must be freed by caller also on error return. */
596 ptr = pb_realloc(ptr, array_size * data_size);
597 if (ptr == NULL)
598 PB_RETURN_ERROR(stream, "realloc failed");
599
600 *(void**)pData = ptr;
601 return true;
602 }
603
604 /* Clear a newly allocated item in case it contains a pointer, or is a submessage. */
initialize_pointer_field(void * pItem,pb_field_iter_t * field)605 static void initialize_pointer_field(void *pItem, pb_field_iter_t *field)
606 {
607 if (PB_LTYPE(field->type) == PB_LTYPE_STRING ||
608 PB_LTYPE(field->type) == PB_LTYPE_BYTES)
609 {
610 *(void**)pItem = NULL;
611 }
612 else if (PB_LTYPE_IS_SUBMSG(field->type))
613 {
614 /* We memset to zero so that any callbacks are set to NULL.
615 * Default values will be set by pb_dec_submessage(). */
616 memset(pItem, 0, field->data_size);
617 }
618 }
619 #endif
620
decode_pointer_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)621 static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
622 {
623 #ifndef PB_ENABLE_MALLOC
624 PB_UNUSED(wire_type);
625 PB_UNUSED(field);
626 PB_RETURN_ERROR(stream, "no malloc support");
627 #else
628 switch (PB_HTYPE(field->type))
629 {
630 case PB_HTYPE_REQUIRED:
631 case PB_HTYPE_OPTIONAL:
632 case PB_HTYPE_ONEOF:
633 if (PB_LTYPE_IS_SUBMSG(field->type) && *(void**)field->pField != NULL)
634 {
635 /* Duplicate field, have to release the old allocation first. */
636 /* FIXME: Does this work correctly for oneofs? */
637 pb_release_single_field(field);
638 }
639
640 if (PB_HTYPE(field->type) == PB_HTYPE_ONEOF)
641 {
642 *(pb_size_t*)field->pSize = field->tag;
643 }
644
645 if (PB_LTYPE(field->type) == PB_LTYPE_STRING ||
646 PB_LTYPE(field->type) == PB_LTYPE_BYTES)
647 {
648 /* pb_dec_string and pb_dec_bytes handle allocation themselves */
649 field->pData = field->pField;
650 return decode_basic_field(stream, wire_type, field);
651 }
652 else
653 {
654 if (!allocate_field(stream, field->pField, field->data_size, 1))
655 return false;
656
657 field->pData = *(void**)field->pField;
658 initialize_pointer_field(field->pData, field);
659 return decode_basic_field(stream, wire_type, field);
660 }
661
662 case PB_HTYPE_REPEATED:
663 if (wire_type == PB_WT_STRING
664 && PB_LTYPE(field->type) <= PB_LTYPE_LAST_PACKABLE)
665 {
666 /* Packed array, multiple items come in at once. */
667 bool status = true;
668 pb_size_t *size = (pb_size_t*)field->pSize;
669 size_t allocated_size = *size;
670 pb_istream_t substream;
671
672 if (!pb_make_string_substream(stream, &substream))
673 return false;
674
675 while (substream.bytes_left)
676 {
677 if (*size == PB_SIZE_MAX)
678 {
679 #ifndef PB_NO_ERRMSG
680 stream->errmsg = "too many array entries";
681 #endif
682 status = false;
683 break;
684 }
685
686 if ((size_t)*size + 1 > allocated_size)
687 {
688 /* Allocate more storage. This tries to guess the
689 * number of remaining entries. Round the division
690 * upwards. */
691 size_t remain = (substream.bytes_left - 1) / field->data_size + 1;
692 if (remain < PB_SIZE_MAX - allocated_size)
693 allocated_size += remain;
694 else
695 allocated_size += 1;
696
697 if (!allocate_field(&substream, field->pField, field->data_size, allocated_size))
698 {
699 status = false;
700 break;
701 }
702 }
703
704 /* Decode the array entry */
705 field->pData = *(char**)field->pField + field->data_size * (*size);
706 initialize_pointer_field(field->pData, field);
707 if (!decode_basic_field(&substream, PB_WT_PACKED, field))
708 {
709 status = false;
710 break;
711 }
712
713 (*size)++;
714 }
715 if (!pb_close_string_substream(stream, &substream))
716 return false;
717
718 return status;
719 }
720 else
721 {
722 /* Normal repeated field, i.e. only one item at a time. */
723 pb_size_t *size = (pb_size_t*)field->pSize;
724
725 if (*size == PB_SIZE_MAX)
726 PB_RETURN_ERROR(stream, "too many array entries");
727
728 if (!allocate_field(stream, field->pField, field->data_size, (size_t)(*size + 1)))
729 return false;
730
731 field->pData = *(char**)field->pField + field->data_size * (*size);
732 (*size)++;
733 initialize_pointer_field(field->pData, field);
734 return decode_basic_field(stream, wire_type, field);
735 }
736
737 default:
738 PB_RETURN_ERROR(stream, "invalid field type");
739 }
740 #endif
741 }
742
decode_callback_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)743 static bool checkreturn decode_callback_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
744 {
745 if (!field->descriptor->field_callback)
746 return pb_skip_field(stream, wire_type);
747
748 if (wire_type == PB_WT_STRING)
749 {
750 pb_istream_t substream;
751 size_t prev_bytes_left;
752
753 if (!pb_make_string_substream(stream, &substream))
754 return false;
755
756 do
757 {
758 prev_bytes_left = substream.bytes_left;
759 if (!field->descriptor->field_callback(&substream, NULL, field))
760 PB_RETURN_ERROR(stream, "callback failed");
761 } while (substream.bytes_left > 0 && substream.bytes_left < prev_bytes_left);
762
763 if (!pb_close_string_substream(stream, &substream))
764 return false;
765
766 return true;
767 }
768 else
769 {
770 /* Copy the single scalar value to stack.
771 * This is required so that we can limit the stream length,
772 * which in turn allows to use same callback for packed and
773 * not-packed fields. */
774 pb_istream_t substream;
775 pb_byte_t buffer[10];
776 size_t size = sizeof(buffer);
777
778 if (!read_raw_value(stream, wire_type, buffer, &size))
779 return false;
780 substream = pb_istream_from_buffer(buffer, size);
781
782 return field->descriptor->field_callback(&substream, NULL, field);
783 }
784 }
785
decode_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)786 static bool checkreturn decode_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
787 {
788 #ifdef PB_ENABLE_MALLOC
789 /* When decoding an oneof field, check if there is old data that must be
790 * released first. */
791 if (PB_HTYPE(field->type) == PB_HTYPE_ONEOF)
792 {
793 if (!pb_release_union_field(stream, field))
794 return false;
795 }
796 #endif
797
798 switch (PB_ATYPE(field->type))
799 {
800 case PB_ATYPE_STATIC:
801 return decode_static_field(stream, wire_type, field);
802
803 case PB_ATYPE_POINTER:
804 return decode_pointer_field(stream, wire_type, field);
805
806 case PB_ATYPE_CALLBACK:
807 return decode_callback_field(stream, wire_type, field);
808
809 default:
810 PB_RETURN_ERROR(stream, "invalid field type");
811 }
812 }
813
814 /* Default handler for extension fields. Expects to have a pb_msgdesc_t
815 * pointer in the extension->type->arg field, pointing to a message with
816 * only one field in it. */
default_extension_decoder(pb_istream_t * stream,pb_extension_t * extension,uint32_t tag,pb_wire_type_t wire_type)817 static bool checkreturn default_extension_decoder(pb_istream_t *stream,
818 pb_extension_t *extension, uint32_t tag, pb_wire_type_t wire_type)
819 {
820 pb_field_iter_t iter;
821
822 if (!pb_field_iter_begin_extension(&iter, extension))
823 PB_RETURN_ERROR(stream, "invalid extension");
824
825 if (iter.tag != tag || !iter.message)
826 return true;
827
828 extension->found = true;
829 return decode_field(stream, wire_type, &iter);
830 }
831
832 /* Try to decode an unknown field as an extension field. Tries each extension
833 * decoder in turn, until one of them handles the field or loop ends. */
decode_extension(pb_istream_t * stream,uint32_t tag,pb_wire_type_t wire_type,pb_extension_t * extension)834 static bool checkreturn decode_extension(pb_istream_t *stream,
835 uint32_t tag, pb_wire_type_t wire_type, pb_extension_t *extension)
836 {
837 size_t pos = stream->bytes_left;
838
839 while (extension != NULL && pos == stream->bytes_left)
840 {
841 bool status;
842 if (extension->type->decode)
843 status = extension->type->decode(stream, extension, tag, wire_type);
844 else
845 status = default_extension_decoder(stream, extension, tag, wire_type);
846
847 if (!status)
848 return false;
849
850 extension = extension->next;
851 }
852
853 return true;
854 }
855
856 /* Initialize message fields to default values, recursively */
pb_field_set_to_default(pb_field_iter_t * field)857 static bool pb_field_set_to_default(pb_field_iter_t *field)
858 {
859 pb_type_t type;
860 type = field->type;
861
862 if (PB_LTYPE(type) == PB_LTYPE_EXTENSION)
863 {
864 pb_extension_t *ext = *(pb_extension_t* const *)field->pData;
865 while (ext != NULL)
866 {
867 pb_field_iter_t ext_iter;
868 if (pb_field_iter_begin_extension(&ext_iter, ext))
869 {
870 ext->found = false;
871 if (!pb_message_set_to_defaults(&ext_iter))
872 return false;
873 }
874 ext = ext->next;
875 }
876 }
877 else if (PB_ATYPE(type) == PB_ATYPE_STATIC)
878 {
879 bool init_data = true;
880 if (PB_HTYPE(type) == PB_HTYPE_OPTIONAL && field->pSize != NULL)
881 {
882 /* Set has_field to false. Still initialize the optional field
883 * itself also. */
884 *(bool*)field->pSize = false;
885 }
886 else if (PB_HTYPE(type) == PB_HTYPE_REPEATED ||
887 PB_HTYPE(type) == PB_HTYPE_ONEOF)
888 {
889 /* REPEATED: Set array count to 0, no need to initialize contents.
890 ONEOF: Set which_field to 0. */
891 *(pb_size_t*)field->pSize = 0;
892 init_data = false;
893 }
894
895 if (init_data)
896 {
897 if (PB_LTYPE_IS_SUBMSG(field->type) &&
898 (field->submsg_desc->default_value != NULL ||
899 field->submsg_desc->field_callback != NULL ||
900 field->submsg_desc->submsg_info[0] != NULL))
901 {
902 /* Initialize submessage to defaults.
903 * Only needed if it has default values
904 * or callback/submessage fields. */
905 pb_field_iter_t submsg_iter;
906 if (pb_field_iter_begin(&submsg_iter, field->submsg_desc, field->pData))
907 {
908 if (!pb_message_set_to_defaults(&submsg_iter))
909 return false;
910 }
911 }
912 else
913 {
914 /* Initialize to zeros */
915 memset(field->pData, 0, (size_t)field->data_size);
916 }
917 }
918 }
919 else if (PB_ATYPE(type) == PB_ATYPE_POINTER)
920 {
921 /* Initialize the pointer to NULL. */
922 *(void**)field->pField = NULL;
923
924 /* Initialize array count to 0. */
925 if (PB_HTYPE(type) == PB_HTYPE_REPEATED ||
926 PB_HTYPE(type) == PB_HTYPE_ONEOF)
927 {
928 *(pb_size_t*)field->pSize = 0;
929 }
930 }
931 else if (PB_ATYPE(type) == PB_ATYPE_CALLBACK)
932 {
933 /* Don't overwrite callback */
934 }
935
936 return true;
937 }
938
pb_message_set_to_defaults(pb_field_iter_t * iter)939 static bool pb_message_set_to_defaults(pb_field_iter_t *iter)
940 {
941 pb_istream_t defstream = PB_ISTREAM_EMPTY;
942 uint32_t tag = 0;
943 pb_wire_type_t wire_type = PB_WT_VARINT;
944 bool eof;
945
946 if (iter->descriptor->default_value)
947 {
948 defstream = pb_istream_from_buffer(iter->descriptor->default_value, (size_t)-1);
949 if (!pb_decode_tag(&defstream, &wire_type, &tag, &eof))
950 return false;
951 }
952
953 do
954 {
955 if (!pb_field_set_to_default(iter))
956 return false;
957
958 if (tag != 0 && iter->tag == tag)
959 {
960 /* We have a default value for this field in the defstream */
961 if (!decode_field(&defstream, wire_type, iter))
962 return false;
963 if (!pb_decode_tag(&defstream, &wire_type, &tag, &eof))
964 return false;
965
966 if (iter->pSize)
967 *(bool*)iter->pSize = false;
968 }
969 } while (pb_field_iter_next(iter));
970
971 return true;
972 }
973
974 /*********************
975 * Decode all fields *
976 *********************/
977
pb_decode_inner(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct,unsigned int flags)978 static bool checkreturn pb_decode_inner(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct, unsigned int flags)
979 {
980 uint32_t extension_range_start = 0;
981 pb_extension_t *extensions = NULL;
982
983 /* 'fixed_count_field' and 'fixed_count_size' track position of a repeated fixed
984 * count field. This can only handle _one_ repeated fixed count field that
985 * is unpacked and unordered among other (non repeated fixed count) fields.
986 */
987 pb_size_t fixed_count_field = PB_SIZE_MAX;
988 pb_size_t fixed_count_size = 0;
989 pb_size_t fixed_count_total_size = 0;
990
991 pb_fields_seen_t fields_seen = {{0, 0}};
992 const uint32_t allbits = ~(uint32_t)0;
993 pb_field_iter_t iter;
994
995 if (pb_field_iter_begin(&iter, fields, dest_struct))
996 {
997 if ((flags & PB_DECODE_NOINIT) == 0)
998 {
999 if (!pb_message_set_to_defaults(&iter))
1000 PB_RETURN_ERROR(stream, "failed to set defaults");
1001 }
1002 }
1003
1004 while (stream->bytes_left)
1005 {
1006 uint32_t tag;
1007 pb_wire_type_t wire_type;
1008 bool eof;
1009
1010 if (!pb_decode_tag(stream, &wire_type, &tag, &eof))
1011 {
1012 if (eof)
1013 break;
1014 else
1015 return false;
1016 }
1017
1018 if (tag == 0)
1019 {
1020 if (flags & PB_DECODE_NULLTERMINATED)
1021 {
1022 break;
1023 }
1024 else
1025 {
1026 PB_RETURN_ERROR(stream, "zero tag");
1027 }
1028 }
1029
1030 if (!pb_field_iter_find(&iter, tag) || PB_LTYPE(iter.type) == PB_LTYPE_EXTENSION)
1031 {
1032 /* No match found, check if it matches an extension. */
1033 if (extension_range_start == 0)
1034 {
1035 if (pb_field_iter_find_extension(&iter))
1036 {
1037 extensions = *(pb_extension_t* const *)iter.pData;
1038 extension_range_start = iter.tag;
1039 }
1040
1041 if (!extensions)
1042 {
1043 extension_range_start = (uint32_t)-1;
1044 }
1045 }
1046
1047 if (tag >= extension_range_start)
1048 {
1049 size_t pos = stream->bytes_left;
1050
1051 if (!decode_extension(stream, tag, wire_type, extensions))
1052 return false;
1053
1054 if (pos != stream->bytes_left)
1055 {
1056 /* The field was handled */
1057 continue;
1058 }
1059 }
1060
1061 /* No match found, skip data */
1062 if (!pb_skip_field(stream, wire_type))
1063 return false;
1064 continue;
1065 }
1066
1067 /* If a repeated fixed count field was found, get size from
1068 * 'fixed_count_field' as there is no counter contained in the struct.
1069 */
1070 if (PB_HTYPE(iter.type) == PB_HTYPE_REPEATED && iter.pSize == &iter.array_size)
1071 {
1072 if (fixed_count_field != iter.index) {
1073 /* If the new fixed count field does not match the previous one,
1074 * check that the previous one is NULL or that it finished
1075 * receiving all the expected data.
1076 */
1077 if (fixed_count_field != PB_SIZE_MAX &&
1078 fixed_count_size != fixed_count_total_size)
1079 {
1080 PB_RETURN_ERROR(stream, "wrong size for fixed count field");
1081 }
1082
1083 fixed_count_field = iter.index;
1084 fixed_count_size = 0;
1085 fixed_count_total_size = iter.array_size;
1086 }
1087
1088 iter.pSize = &fixed_count_size;
1089 }
1090
1091 if (PB_HTYPE(iter.type) == PB_HTYPE_REQUIRED
1092 && iter.required_field_index < PB_MAX_REQUIRED_FIELDS)
1093 {
1094 uint32_t tmp = ((uint32_t)1 << (iter.required_field_index & 31));
1095 fields_seen.bitfield[iter.required_field_index >> 5] |= tmp;
1096 }
1097
1098 if (!decode_field(stream, wire_type, &iter))
1099 return false;
1100 }
1101
1102 /* Check that all elements of the last decoded fixed count field were present. */
1103 if (fixed_count_field != PB_SIZE_MAX &&
1104 fixed_count_size != fixed_count_total_size)
1105 {
1106 PB_RETURN_ERROR(stream, "wrong size for fixed count field");
1107 }
1108
1109 /* Check that all required fields were present. */
1110 {
1111 pb_size_t req_field_count = iter.descriptor->required_field_count;
1112
1113 if (req_field_count > 0)
1114 {
1115 pb_size_t i;
1116
1117 if (req_field_count > PB_MAX_REQUIRED_FIELDS)
1118 req_field_count = PB_MAX_REQUIRED_FIELDS;
1119
1120 /* Check the whole words */
1121 for (i = 0; i < (req_field_count >> 5); i++)
1122 {
1123 if (fields_seen.bitfield[i] != allbits)
1124 PB_RETURN_ERROR(stream, "missing required field");
1125 }
1126
1127 /* Check the remaining bits (if any) */
1128 if ((req_field_count & 31) != 0)
1129 {
1130 if (fields_seen.bitfield[req_field_count >> 5] !=
1131 (allbits >> (uint_least8_t)(32 - (req_field_count & 31))))
1132 {
1133 PB_RETURN_ERROR(stream, "missing required field");
1134 }
1135 }
1136 }
1137 }
1138
1139 return true;
1140 }
1141
pb_decode_ex(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct,unsigned int flags)1142 bool checkreturn pb_decode_ex(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct, unsigned int flags)
1143 {
1144 bool status;
1145
1146 if ((flags & PB_DECODE_DELIMITED) == 0)
1147 {
1148 status = pb_decode_inner(stream, fields, dest_struct, flags);
1149 }
1150 else
1151 {
1152 pb_istream_t substream;
1153 if (!pb_make_string_substream(stream, &substream))
1154 return false;
1155
1156 status = pb_decode_inner(&substream, fields, dest_struct, flags);
1157
1158 if (!pb_close_string_substream(stream, &substream))
1159 return false;
1160 }
1161
1162 #ifdef PB_ENABLE_MALLOC
1163 if (!status)
1164 pb_release(fields, dest_struct);
1165 #endif
1166
1167 return status;
1168 }
1169
pb_decode(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct)1170 bool checkreturn pb_decode(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct)
1171 {
1172 bool status;
1173
1174 status = pb_decode_inner(stream, fields, dest_struct, 0);
1175
1176 #ifdef PB_ENABLE_MALLOC
1177 if (!status)
1178 pb_release(fields, dest_struct);
1179 #endif
1180
1181 return status;
1182 }
1183
1184 #ifdef PB_ENABLE_MALLOC
1185 /* Given an oneof field, if there has already been a field inside this oneof,
1186 * release it before overwriting with a different one. */
pb_release_union_field(pb_istream_t * stream,pb_field_iter_t * field)1187 static bool pb_release_union_field(pb_istream_t *stream, pb_field_iter_t *field)
1188 {
1189 pb_field_iter_t old_field = *field;
1190 pb_size_t old_tag = *(pb_size_t*)field->pSize; /* Previous which_ value */
1191 pb_size_t new_tag = field->tag; /* New which_ value */
1192
1193 if (old_tag == 0)
1194 return true; /* Ok, no old data in union */
1195
1196 if (old_tag == new_tag)
1197 return true; /* Ok, old data is of same type => merge */
1198
1199 /* Release old data. The find can fail if the message struct contains
1200 * invalid data. */
1201 if (!pb_field_iter_find(&old_field, old_tag))
1202 PB_RETURN_ERROR(stream, "invalid union tag");
1203
1204 pb_release_single_field(&old_field);
1205
1206 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1207 {
1208 /* Initialize the pointer to NULL to make sure it is valid
1209 * even in case of error return. */
1210 *(void**)field->pField = NULL;
1211 field->pData = NULL;
1212 }
1213
1214 return true;
1215 }
1216
pb_release_single_field(pb_field_iter_t * field)1217 static void pb_release_single_field(pb_field_iter_t *field)
1218 {
1219 pb_type_t type;
1220 type = field->type;
1221
1222 if (PB_HTYPE(type) == PB_HTYPE_ONEOF)
1223 {
1224 if (*(pb_size_t*)field->pSize != field->tag)
1225 return; /* This is not the current field in the union */
1226 }
1227
1228 /* Release anything contained inside an extension or submsg.
1229 * This has to be done even if the submsg itself is statically
1230 * allocated. */
1231 if (PB_LTYPE(type) == PB_LTYPE_EXTENSION)
1232 {
1233 /* Release fields from all extensions in the linked list */
1234 pb_extension_t *ext = *(pb_extension_t**)field->pData;
1235 while (ext != NULL)
1236 {
1237 pb_field_iter_t ext_iter;
1238 if (pb_field_iter_begin_extension(&ext_iter, ext))
1239 {
1240 pb_release_single_field(&ext_iter);
1241 }
1242 ext = ext->next;
1243 }
1244 }
1245 else if (PB_LTYPE_IS_SUBMSG(type) && PB_ATYPE(type) != PB_ATYPE_CALLBACK)
1246 {
1247 /* Release fields in submessage or submsg array */
1248 pb_size_t count = 1;
1249
1250 if (PB_ATYPE(type) == PB_ATYPE_POINTER)
1251 {
1252 field->pData = *(void**)field->pField;
1253 }
1254 else
1255 {
1256 field->pData = field->pField;
1257 }
1258
1259 if (PB_HTYPE(type) == PB_HTYPE_REPEATED)
1260 {
1261 count = *(pb_size_t*)field->pSize;
1262
1263 if (PB_ATYPE(type) == PB_ATYPE_STATIC && count > field->array_size)
1264 {
1265 /* Protect against corrupted _count fields */
1266 count = field->array_size;
1267 }
1268 }
1269
1270 if (field->pData)
1271 {
1272 for (; count > 0; count--)
1273 {
1274 pb_release(field->submsg_desc, field->pData);
1275 field->pData = (char*)field->pData + field->data_size;
1276 }
1277 }
1278 }
1279
1280 if (PB_ATYPE(type) == PB_ATYPE_POINTER)
1281 {
1282 if (PB_HTYPE(type) == PB_HTYPE_REPEATED &&
1283 (PB_LTYPE(type) == PB_LTYPE_STRING ||
1284 PB_LTYPE(type) == PB_LTYPE_BYTES))
1285 {
1286 /* Release entries in repeated string or bytes array */
1287 void **pItem = *(void***)field->pField;
1288 pb_size_t count = *(pb_size_t*)field->pSize;
1289 for (; count > 0; count--)
1290 {
1291 pb_free(*pItem);
1292 *pItem++ = NULL;
1293 }
1294 }
1295
1296 if (PB_HTYPE(type) == PB_HTYPE_REPEATED)
1297 {
1298 /* We are going to release the array, so set the size to 0 */
1299 *(pb_size_t*)field->pSize = 0;
1300 }
1301
1302 /* Release main pointer */
1303 pb_free(*(void**)field->pField);
1304 *(void**)field->pField = NULL;
1305 }
1306 }
1307
pb_release(const pb_msgdesc_t * fields,void * dest_struct)1308 void pb_release(const pb_msgdesc_t *fields, void *dest_struct)
1309 {
1310 pb_field_iter_t iter;
1311
1312 if (!dest_struct)
1313 return; /* Ignore NULL pointers, similar to free() */
1314
1315 if (!pb_field_iter_begin(&iter, fields, dest_struct))
1316 return; /* Empty message type */
1317
1318 do
1319 {
1320 pb_release_single_field(&iter);
1321 } while (pb_field_iter_next(&iter));
1322 }
1323 #endif
1324
1325 /* Field decoders */
1326
pb_decode_bool(pb_istream_t * stream,bool * dest)1327 bool pb_decode_bool(pb_istream_t *stream, bool *dest)
1328 {
1329 uint32_t value;
1330 if (!pb_decode_varint32(stream, &value))
1331 return false;
1332
1333 *(bool*)dest = (value != 0);
1334 return true;
1335 }
1336
pb_decode_svarint(pb_istream_t * stream,pb_int64_t * dest)1337 bool pb_decode_svarint(pb_istream_t *stream, pb_int64_t *dest)
1338 {
1339 pb_uint64_t value;
1340 if (!pb_decode_varint(stream, &value))
1341 return false;
1342
1343 if (value & 1)
1344 *dest = (pb_int64_t)(~(value >> 1));
1345 else
1346 *dest = (pb_int64_t)(value >> 1);
1347
1348 return true;
1349 }
1350
pb_decode_fixed32(pb_istream_t * stream,void * dest)1351 bool pb_decode_fixed32(pb_istream_t *stream, void *dest)
1352 {
1353 union {
1354 uint32_t fixed32;
1355 pb_byte_t bytes[4];
1356 } u;
1357
1358 if (!pb_read(stream, u.bytes, 4))
1359 return false;
1360
1361 #if defined(__BYTE_ORDER) && __BYTE_ORDER == __LITTLE_ENDIAN && CHAR_BIT == 8
1362 /* fast path - if we know that we're on little endian, assign directly */
1363 *(uint32_t*)dest = u.fixed32;
1364 #else
1365 *(uint32_t*)dest = ((uint32_t)u.bytes[0] << 0) |
1366 ((uint32_t)u.bytes[1] << 8) |
1367 ((uint32_t)u.bytes[2] << 16) |
1368 ((uint32_t)u.bytes[3] << 24);
1369 #endif
1370 return true;
1371 }
1372
1373 #ifndef PB_WITHOUT_64BIT
pb_decode_fixed64(pb_istream_t * stream,void * dest)1374 bool pb_decode_fixed64(pb_istream_t *stream, void *dest)
1375 {
1376 union {
1377 uint64_t fixed64;
1378 pb_byte_t bytes[8];
1379 } u;
1380
1381 if (!pb_read(stream, u.bytes, 8))
1382 return false;
1383
1384 #if defined(__BYTE_ORDER) && __BYTE_ORDER == __LITTLE_ENDIAN && CHAR_BIT == 8
1385 /* fast path - if we know that we're on little endian, assign directly */
1386 *(uint64_t*)dest = u.fixed64;
1387 #else
1388 *(uint64_t*)dest = ((uint64_t)u.bytes[0] << 0) |
1389 ((uint64_t)u.bytes[1] << 8) |
1390 ((uint64_t)u.bytes[2] << 16) |
1391 ((uint64_t)u.bytes[3] << 24) |
1392 ((uint64_t)u.bytes[4] << 32) |
1393 ((uint64_t)u.bytes[5] << 40) |
1394 ((uint64_t)u.bytes[6] << 48) |
1395 ((uint64_t)u.bytes[7] << 56);
1396 #endif
1397 return true;
1398 }
1399 #endif
1400
pb_dec_bool(pb_istream_t * stream,const pb_field_iter_t * field)1401 static bool checkreturn pb_dec_bool(pb_istream_t *stream, const pb_field_iter_t *field)
1402 {
1403 return pb_decode_bool(stream, (bool*)field->pData);
1404 }
1405
pb_dec_varint(pb_istream_t * stream,const pb_field_iter_t * field)1406 static bool checkreturn pb_dec_varint(pb_istream_t *stream, const pb_field_iter_t *field)
1407 {
1408 if (PB_LTYPE(field->type) == PB_LTYPE_UVARINT)
1409 {
1410 pb_uint64_t value, clamped;
1411 if (!pb_decode_varint(stream, &value))
1412 return false;
1413
1414 /* Cast to the proper field size, while checking for overflows */
1415 if (field->data_size == sizeof(pb_uint64_t))
1416 clamped = *(pb_uint64_t*)field->pData = value;
1417 else if (field->data_size == sizeof(uint32_t))
1418 clamped = *(uint32_t*)field->pData = (uint32_t)value;
1419 else if (field->data_size == sizeof(uint_least16_t))
1420 clamped = *(uint_least16_t*)field->pData = (uint_least16_t)value;
1421 else if (field->data_size == sizeof(uint_least8_t))
1422 clamped = *(uint_least8_t*)field->pData = (uint_least8_t)value;
1423 else
1424 PB_RETURN_ERROR(stream, "invalid data_size");
1425
1426 if (clamped != value)
1427 PB_RETURN_ERROR(stream, "integer too large");
1428
1429 return true;
1430 }
1431 else
1432 {
1433 pb_uint64_t value;
1434 pb_int64_t svalue;
1435 pb_int64_t clamped;
1436
1437 if (PB_LTYPE(field->type) == PB_LTYPE_SVARINT)
1438 {
1439 if (!pb_decode_svarint(stream, &svalue))
1440 return false;
1441 }
1442 else
1443 {
1444 if (!pb_decode_varint(stream, &value))
1445 return false;
1446
1447 /* See issue 97: Google's C++ protobuf allows negative varint values to
1448 * be cast as int32_t, instead of the int64_t that should be used when
1449 * encoding. Nanopb versions before 0.2.5 had a bug in encoding. In order to
1450 * not break decoding of such messages, we cast <=32 bit fields to
1451 * int32_t first to get the sign correct.
1452 */
1453 if (field->data_size == sizeof(pb_int64_t))
1454 svalue = (pb_int64_t)value;
1455 else
1456 svalue = (int32_t)value;
1457 }
1458
1459 /* Cast to the proper field size, while checking for overflows */
1460 if (field->data_size == sizeof(pb_int64_t))
1461 clamped = *(pb_int64_t*)field->pData = svalue;
1462 else if (field->data_size == sizeof(int32_t))
1463 clamped = *(int32_t*)field->pData = (int32_t)svalue;
1464 else if (field->data_size == sizeof(int_least16_t))
1465 clamped = *(int_least16_t*)field->pData = (int_least16_t)svalue;
1466 else if (field->data_size == sizeof(int_least8_t))
1467 clamped = *(int_least8_t*)field->pData = (int_least8_t)svalue;
1468 else
1469 PB_RETURN_ERROR(stream, "invalid data_size");
1470
1471 if (clamped != svalue)
1472 PB_RETURN_ERROR(stream, "integer too large");
1473
1474 return true;
1475 }
1476 }
1477
pb_dec_bytes(pb_istream_t * stream,const pb_field_iter_t * field)1478 static bool checkreturn pb_dec_bytes(pb_istream_t *stream, const pb_field_iter_t *field)
1479 {
1480 uint32_t size;
1481 size_t alloc_size;
1482 pb_bytes_array_t *dest;
1483
1484 if (!pb_decode_varint32(stream, &size))
1485 return false;
1486
1487 if (size > PB_SIZE_MAX)
1488 PB_RETURN_ERROR(stream, "bytes overflow");
1489
1490 alloc_size = PB_BYTES_ARRAY_T_ALLOCSIZE(size);
1491 if (size > alloc_size)
1492 PB_RETURN_ERROR(stream, "size too large");
1493
1494 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1495 {
1496 #ifndef PB_ENABLE_MALLOC
1497 PB_RETURN_ERROR(stream, "no malloc support");
1498 #else
1499 if (stream->bytes_left < size)
1500 PB_RETURN_ERROR(stream, "end-of-stream");
1501
1502 if (!allocate_field(stream, field->pData, alloc_size, 1))
1503 return false;
1504 dest = *(pb_bytes_array_t**)field->pData;
1505 #endif
1506 }
1507 else
1508 {
1509 if (alloc_size > field->data_size)
1510 PB_RETURN_ERROR(stream, "bytes overflow");
1511 dest = (pb_bytes_array_t*)field->pData;
1512 }
1513
1514 dest->size = (pb_size_t)size;
1515 return pb_read(stream, dest->bytes, (size_t)size);
1516 }
1517
pb_dec_string(pb_istream_t * stream,const pb_field_iter_t * field)1518 static bool checkreturn pb_dec_string(pb_istream_t *stream, const pb_field_iter_t *field)
1519 {
1520 uint32_t size;
1521 size_t alloc_size;
1522 pb_byte_t *dest = (pb_byte_t*)field->pData;
1523
1524 if (!pb_decode_varint32(stream, &size))
1525 return false;
1526
1527 if (size == (uint32_t)-1)
1528 PB_RETURN_ERROR(stream, "size too large");
1529
1530 /* Space for null terminator */
1531 alloc_size = (size_t)(size + 1);
1532
1533 if (alloc_size < size)
1534 PB_RETURN_ERROR(stream, "size too large");
1535
1536 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1537 {
1538 #ifndef PB_ENABLE_MALLOC
1539 PB_RETURN_ERROR(stream, "no malloc support");
1540 #else
1541 if (stream->bytes_left < size)
1542 PB_RETURN_ERROR(stream, "end-of-stream");
1543
1544 if (!allocate_field(stream, field->pData, alloc_size, 1))
1545 return false;
1546 dest = *(pb_byte_t**)field->pData;
1547 #endif
1548 }
1549 else
1550 {
1551 if (alloc_size > field->data_size)
1552 PB_RETURN_ERROR(stream, "string overflow");
1553 }
1554
1555 dest[size] = 0;
1556
1557 if (!pb_read(stream, dest, (size_t)size))
1558 return false;
1559
1560 #ifdef PB_VALIDATE_UTF8
1561 if (!pb_validate_utf8((const char*)dest))
1562 PB_RETURN_ERROR(stream, "invalid utf8");
1563 #endif
1564
1565 return true;
1566 }
1567
pb_dec_submessage(pb_istream_t * stream,const pb_field_iter_t * field)1568 static bool checkreturn pb_dec_submessage(pb_istream_t *stream, const pb_field_iter_t *field)
1569 {
1570 bool status = true;
1571 bool submsg_consumed = false;
1572 pb_istream_t substream;
1573
1574 if (!pb_make_string_substream(stream, &substream))
1575 return false;
1576
1577 if (field->submsg_desc == NULL)
1578 PB_RETURN_ERROR(stream, "invalid field descriptor");
1579
1580 /* Submessages can have a separate message-level callback that is called
1581 * before decoding the message. Typically it is used to set callback fields
1582 * inside oneofs. */
1583 if (PB_LTYPE(field->type) == PB_LTYPE_SUBMSG_W_CB && field->pSize != NULL)
1584 {
1585 /* Message callback is stored right before pSize. */
1586 pb_callback_t *callback = (pb_callback_t*)field->pSize - 1;
1587 if (callback->funcs.decode)
1588 {
1589 status = callback->funcs.decode(&substream, field, &callback->arg);
1590
1591 if (substream.bytes_left == 0)
1592 {
1593 submsg_consumed = true;
1594 }
1595 }
1596 }
1597
1598 /* Now decode the submessage contents */
1599 if (status && !submsg_consumed)
1600 {
1601 unsigned int flags = 0;
1602
1603 /* Static required/optional fields are already initialized by top-level
1604 * pb_decode(), no need to initialize them again. */
1605 if (PB_ATYPE(field->type) == PB_ATYPE_STATIC &&
1606 PB_HTYPE(field->type) != PB_HTYPE_REPEATED)
1607 {
1608 flags = PB_DECODE_NOINIT;
1609 }
1610
1611 status = pb_decode_inner(&substream, field->submsg_desc, field->pData, flags);
1612 }
1613
1614 if (!pb_close_string_substream(stream, &substream))
1615 return false;
1616
1617 return status;
1618 }
1619
pb_dec_fixed_length_bytes(pb_istream_t * stream,const pb_field_iter_t * field)1620 static bool checkreturn pb_dec_fixed_length_bytes(pb_istream_t *stream, const pb_field_iter_t *field)
1621 {
1622 uint32_t size;
1623
1624 if (!pb_decode_varint32(stream, &size))
1625 return false;
1626
1627 if (size > PB_SIZE_MAX)
1628 PB_RETURN_ERROR(stream, "bytes overflow");
1629
1630 if (size == 0)
1631 {
1632 /* As a special case, treat empty bytes string as all zeros for fixed_length_bytes. */
1633 memset(field->pData, 0, (size_t)field->data_size);
1634 return true;
1635 }
1636
1637 if (size != field->data_size)
1638 PB_RETURN_ERROR(stream, "incorrect fixed length bytes size");
1639
1640 return pb_read(stream, (pb_byte_t*)field->pData, (size_t)field->data_size);
1641 }
1642
1643 #ifdef PB_CONVERT_DOUBLE_FLOAT
pb_decode_double_as_float(pb_istream_t * stream,float * dest)1644 bool pb_decode_double_as_float(pb_istream_t *stream, float *dest)
1645 {
1646 uint_least8_t sign;
1647 int exponent;
1648 uint32_t mantissa;
1649 uint64_t value;
1650 union { float f; uint32_t i; } out;
1651
1652 if (!pb_decode_fixed64(stream, &value))
1653 return false;
1654
1655 /* Decompose input value */
1656 sign = (uint_least8_t)((value >> 63) & 1);
1657 exponent = (int)((value >> 52) & 0x7FF) - 1023;
1658 mantissa = (value >> 28) & 0xFFFFFF; /* Highest 24 bits */
1659
1660 /* Figure if value is in range representable by floats. */
1661 if (exponent == 1024)
1662 {
1663 /* Special value */
1664 exponent = 128;
1665 mantissa >>= 1;
1666 }
1667 else
1668 {
1669 if (exponent > 127)
1670 {
1671 /* Too large, convert to infinity */
1672 exponent = 128;
1673 mantissa = 0;
1674 }
1675 else if (exponent < -150)
1676 {
1677 /* Too small, convert to zero */
1678 exponent = -127;
1679 mantissa = 0;
1680 }
1681 else if (exponent < -126)
1682 {
1683 /* Denormalized */
1684 mantissa |= 0x1000000;
1685 mantissa >>= (-126 - exponent);
1686 exponent = -127;
1687 }
1688
1689 /* Round off mantissa */
1690 mantissa = (mantissa + 1) >> 1;
1691
1692 /* Check if mantissa went over 2.0 */
1693 if (mantissa & 0x800000)
1694 {
1695 exponent += 1;
1696 mantissa &= 0x7FFFFF;
1697 mantissa >>= 1;
1698 }
1699 }
1700
1701 /* Combine fields */
1702 out.i = mantissa;
1703 out.i |= (uint32_t)(exponent + 127) << 23;
1704 out.i |= (uint32_t)sign << 31;
1705
1706 *dest = out.f;
1707 return true;
1708 }
1709 #endif
1710
