1 /* pb_decode.c -- decode a protobuf using minimal resources
2 *
3 * 2011 Petteri Aimonen <jpa@kapsi.fi>
4 */
5
6 /* Use the GCC warn_unused_result attribute to check that all return values
7 * are propagated correctly. On other compilers, gcc before 3.4.0 and iar
8 * before 9.40.1 just ignore the annotation.
9 */
10 #if (defined(__GNUC__) && ((__GNUC__ > 3) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4))) || \
11 (defined(__IAR_SYSTEMS_ICC__) && (__VER__ >= 9040001))
12 #define checkreturn __attribute__((warn_unused_result))
13 #else
14 #define checkreturn
15 #endif
16
17 #include "pb.h"
18 #include "pb_decode.h"
19 #include "pb_common.h"
20
21 /**************************************
22 * Declarations internal to this file *
23 **************************************/
24
25 static bool checkreturn buf_read(pb_istream_t *stream, pb_byte_t *buf, size_t count);
26 static bool checkreturn read_raw_value(pb_istream_t *stream, pb_wire_type_t wire_type, pb_byte_t *buf, size_t *size);
27 static bool checkreturn decode_basic_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
28 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
29 static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
30 static bool checkreturn decode_callback_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
31 static bool checkreturn decode_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field);
32 static bool checkreturn default_extension_decoder(pb_istream_t *stream, pb_extension_t *extension, uint32_t tag, pb_wire_type_t wire_type);
33 static bool checkreturn decode_extension(pb_istream_t *stream, uint32_t tag, pb_wire_type_t wire_type, pb_extension_t *extension);
34 static bool pb_field_set_to_default(pb_field_iter_t *field);
35 static bool pb_message_set_to_defaults(pb_field_iter_t *iter);
36 static bool checkreturn pb_dec_bool(pb_istream_t *stream, const pb_field_iter_t *field);
37 static bool checkreturn pb_dec_varint(pb_istream_t *stream, const pb_field_iter_t *field);
38 static bool checkreturn pb_dec_bytes(pb_istream_t *stream, const pb_field_iter_t *field);
39 static bool checkreturn pb_dec_string(pb_istream_t *stream, const pb_field_iter_t *field);
40 static bool checkreturn pb_dec_submessage(pb_istream_t *stream, const pb_field_iter_t *field);
41 static bool checkreturn pb_dec_fixed_length_bytes(pb_istream_t *stream, const pb_field_iter_t *field);
42 static bool checkreturn pb_skip_varint(pb_istream_t *stream);
43 static bool checkreturn pb_skip_string(pb_istream_t *stream);
44
45 #ifdef PB_ENABLE_MALLOC
46 static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t data_size, size_t array_size);
47 static void initialize_pointer_field(void *pItem, pb_field_iter_t *field);
48 static bool checkreturn pb_release_union_field(pb_istream_t *stream, pb_field_iter_t *field);
49 static void pb_release_single_field(pb_field_iter_t *field);
50 #endif
51
52 #ifdef PB_WITHOUT_64BIT
53 #define pb_int64_t int32_t
54 #define pb_uint64_t uint32_t
55 #else
56 #define pb_int64_t int64_t
57 #define pb_uint64_t uint64_t
58 #endif
59
60 typedef struct {
61 uint32_t bitfield[(PB_MAX_REQUIRED_FIELDS + 31) / 32];
62 } pb_fields_seen_t;
63
64 /*******************************
65 * pb_istream_t implementation *
66 *******************************/
67
buf_read(pb_istream_t * stream,pb_byte_t * buf,size_t count)68 static bool checkreturn buf_read(pb_istream_t *stream, pb_byte_t *buf, size_t count)
69 {
70 const pb_byte_t *source = (const pb_byte_t*)stream->state;
71 stream->state = (pb_byte_t*)stream->state + count;
72
73 if (buf != NULL)
74 {
75 memcpy(buf, source, count * sizeof(pb_byte_t));
76 }
77
78 return true;
79 }
80
pb_read(pb_istream_t * stream,pb_byte_t * buf,size_t count)81 bool checkreturn pb_read(pb_istream_t *stream, pb_byte_t *buf, size_t count)
82 {
83 if (count == 0)
84 return true;
85
86 #ifndef PB_BUFFER_ONLY
87 if (buf == NULL && stream->callback != buf_read)
88 {
89 /* Skip input bytes */
90 pb_byte_t tmp[16];
91 while (count > 16)
92 {
93 if (!pb_read(stream, tmp, 16))
94 return false;
95
96 count -= 16;
97 }
98
99 return pb_read(stream, tmp, count);
100 }
101 #endif
102
103 if (stream->bytes_left < count)
104 PB_RETURN_ERROR(stream, "end-of-stream");
105
106 #ifndef PB_BUFFER_ONLY
107 if (!stream->callback(stream, buf, count))
108 PB_RETURN_ERROR(stream, "io error");
109 #else
110 if (!buf_read(stream, buf, count))
111 return false;
112 #endif
113
114 if (stream->bytes_left < count)
115 stream->bytes_left = 0;
116 else
117 stream->bytes_left -= count;
118
119 return true;
120 }
121
122 /* Read a single byte from input stream. buf may not be NULL.
123 * This is an optimization for the varint decoding. */
pb_readbyte(pb_istream_t * stream,pb_byte_t * buf)124 static bool checkreturn pb_readbyte(pb_istream_t *stream, pb_byte_t *buf)
125 {
126 if (stream->bytes_left == 0)
127 PB_RETURN_ERROR(stream, "end-of-stream");
128
129 #ifndef PB_BUFFER_ONLY
130 if (!stream->callback(stream, buf, 1))
131 PB_RETURN_ERROR(stream, "io error");
132 #else
133 *buf = *(const pb_byte_t*)stream->state;
134 stream->state = (pb_byte_t*)stream->state + 1;
135 #endif
136
137 stream->bytes_left--;
138
139 return true;
140 }
141
pb_istream_from_buffer(const pb_byte_t * buf,size_t msglen)142 pb_istream_t pb_istream_from_buffer(const pb_byte_t *buf, size_t msglen)
143 {
144 pb_istream_t stream;
145 /* Cast away the const from buf without a compiler error. We are
146 * careful to use it only in a const manner in the callbacks.
147 */
148 union {
149 void *state;
150 const void *c_state;
151 } state;
152 #ifdef PB_BUFFER_ONLY
153 stream.callback = NULL;
154 #else
155 stream.callback = &buf_read;
156 #endif
157 state.c_state = buf;
158 stream.state = state.state;
159 stream.bytes_left = msglen;
160 #ifndef PB_NO_ERRMSG
161 stream.errmsg = NULL;
162 #endif
163 return stream;
164 }
165
166
167 /********************
168 * Helper functions *
169 ********************/
170
pb_decode_varint32(pb_istream_t * stream,uint32_t * dest)171 bool checkreturn pb_decode_varint32(pb_istream_t *stream, uint32_t *dest)
172 {
173 pb_byte_t byte;
174 uint32_t result;
175
176 if (!pb_readbyte(stream, &byte))
177 {
178 return false;
179 }
180
181 if ((byte & 0x80) == 0)
182 {
183 /* Quick case, 1 byte value */
184 result = byte;
185 }
186 else
187 {
188 /* Multibyte case */
189 uint_fast8_t bitpos = 7;
190 result = byte & 0x7F;
191
192 do
193 {
194 if (!pb_readbyte(stream, &byte))
195 return false;
196
197 if (bitpos >= 32)
198 {
199 /* Note: The varint could have trailing 0x80 bytes, or 0xFF for negative. */
200 pb_byte_t sign_extension = (bitpos < 63) ? 0xFF : 0x01;
201 bool valid_extension = ((byte & 0x7F) == 0x00 ||
202 ((result >> 31) != 0 && byte == sign_extension));
203
204 if (bitpos >= 64 || !valid_extension)
205 {
206 PB_RETURN_ERROR(stream, "varint overflow");
207 }
208 }
209 else if (bitpos == 28)
210 {
211 if ((byte & 0x70) != 0 && (byte & 0x78) != 0x78)
212 {
213 PB_RETURN_ERROR(stream, "varint overflow");
214 }
215 result |= (uint32_t)(byte & 0x0F) << bitpos;
216 }
217 else
218 {
219 result |= (uint32_t)(byte & 0x7F) << bitpos;
220 }
221 bitpos = (uint_fast8_t)(bitpos + 7);
222 } while (byte & 0x80);
223 }
224
225 *dest = result;
226 return true;
227 }
228
229 #ifndef PB_WITHOUT_64BIT
pb_decode_varint(pb_istream_t * stream,uint64_t * dest)230 bool checkreturn pb_decode_varint(pb_istream_t *stream, uint64_t *dest)
231 {
232 pb_byte_t byte;
233 uint_fast8_t bitpos = 0;
234 uint64_t result = 0;
235
236 do
237 {
238 if (!pb_readbyte(stream, &byte))
239 return false;
240
241 if (bitpos >= 63 && (byte & 0xFE) != 0)
242 PB_RETURN_ERROR(stream, "varint overflow");
243
244 result |= (uint64_t)(byte & 0x7F) << bitpos;
245 bitpos = (uint_fast8_t)(bitpos + 7);
246 } while (byte & 0x80);
247
248 *dest = result;
249 return true;
250 }
251 #endif
252
pb_skip_varint(pb_istream_t * stream)253 bool checkreturn pb_skip_varint(pb_istream_t *stream)
254 {
255 pb_byte_t byte;
256 do
257 {
258 if (!pb_read(stream, &byte, 1))
259 return false;
260 } while (byte & 0x80);
261 return true;
262 }
263
pb_skip_string(pb_istream_t * stream)264 bool checkreturn pb_skip_string(pb_istream_t *stream)
265 {
266 uint32_t length;
267 if (!pb_decode_varint32(stream, &length))
268 return false;
269
270 if ((size_t)length != length)
271 {
272 PB_RETURN_ERROR(stream, "size too large");
273 }
274
275 return pb_read(stream, NULL, (size_t)length);
276 }
277
pb_decode_tag(pb_istream_t * stream,pb_wire_type_t * wire_type,uint32_t * tag,bool * eof)278 bool checkreturn pb_decode_tag(pb_istream_t *stream, pb_wire_type_t *wire_type, uint32_t *tag, bool *eof)
279 {
280 uint32_t temp;
281 *eof = false;
282 *wire_type = (pb_wire_type_t) 0;
283 *tag = 0;
284
285 if (stream->bytes_left == 0)
286 {
287 *eof = true;
288 return false;
289 }
290
291 if (!pb_decode_varint32(stream, &temp))
292 {
293 #ifndef PB_BUFFER_ONLY
294 /* Workaround for issue #1017
295 *
296 * Callback streams don't set bytes_left to 0 on eof until after being called by pb_decode_varint32,
297 * which results in "io error" being raised. This contrasts the behavior of buffer streams who raise
298 * no error on eof as bytes_left is already 0 on entry. This causes legitimate errors (e.g. missing
299 * required fields) to be incorrectly reported by callback streams.
300 */
301 if (stream->callback != buf_read && stream->bytes_left == 0)
302 {
303 #ifndef PB_NO_ERRMSG
304 if (strcmp(stream->errmsg, "io error") == 0)
305 stream->errmsg = NULL;
306 #endif
307 *eof = true;
308 }
309 #endif
310 return false;
311 }
312
313 *tag = temp >> 3;
314 *wire_type = (pb_wire_type_t)(temp & 7);
315 return true;
316 }
317
pb_skip_field(pb_istream_t * stream,pb_wire_type_t wire_type)318 bool checkreturn pb_skip_field(pb_istream_t *stream, pb_wire_type_t wire_type)
319 {
320 switch (wire_type)
321 {
322 case PB_WT_VARINT: return pb_skip_varint(stream);
323 case PB_WT_64BIT: return pb_read(stream, NULL, 8);
324 case PB_WT_STRING: return pb_skip_string(stream);
325 case PB_WT_32BIT: return pb_read(stream, NULL, 4);
326 case PB_WT_PACKED:
327 /* Calling pb_skip_field with a PB_WT_PACKED is an error.
328 * Explicitly handle this case and fallthrough to default to avoid
329 * compiler warnings.
330 */
331 default: PB_RETURN_ERROR(stream, "invalid wire_type");
332 }
333 }
334
335 /* Read a raw value to buffer, for the purpose of passing it to callback as
336 * a substream. Size is maximum size on call, and actual size on return.
337 */
read_raw_value(pb_istream_t * stream,pb_wire_type_t wire_type,pb_byte_t * buf,size_t * size)338 static bool checkreturn read_raw_value(pb_istream_t *stream, pb_wire_type_t wire_type, pb_byte_t *buf, size_t *size)
339 {
340 size_t max_size = *size;
341 switch (wire_type)
342 {
343 case PB_WT_VARINT:
344 *size = 0;
345 do
346 {
347 (*size)++;
348 if (*size > max_size)
349 PB_RETURN_ERROR(stream, "varint overflow");
350
351 if (!pb_read(stream, buf, 1))
352 return false;
353 } while (*buf++ & 0x80);
354 return true;
355
356 case PB_WT_64BIT:
357 *size = 8;
358 return pb_read(stream, buf, 8);
359
360 case PB_WT_32BIT:
361 *size = 4;
362 return pb_read(stream, buf, 4);
363
364 case PB_WT_STRING:
365 /* Calling read_raw_value with a PB_WT_STRING is an error.
366 * Explicitly handle this case and fallthrough to default to avoid
367 * compiler warnings.
368 */
369
370 case PB_WT_PACKED:
371 /* Calling read_raw_value with a PB_WT_PACKED is an error.
372 * Explicitly handle this case and fallthrough to default to avoid
373 * compiler warnings.
374 */
375
376 default: PB_RETURN_ERROR(stream, "invalid wire_type");
377 }
378 }
379
380 /* Decode string length from stream and return a substream with limited length.
381 * Remember to close the substream using pb_close_string_substream().
382 */
pb_make_string_substream(pb_istream_t * stream,pb_istream_t * substream)383 bool checkreturn pb_make_string_substream(pb_istream_t *stream, pb_istream_t *substream)
384 {
385 uint32_t size;
386 if (!pb_decode_varint32(stream, &size))
387 return false;
388
389 *substream = *stream;
390 if (substream->bytes_left < size)
391 PB_RETURN_ERROR(stream, "parent stream too short");
392
393 substream->bytes_left = (size_t)size;
394 stream->bytes_left -= (size_t)size;
395 return true;
396 }
397
pb_close_string_substream(pb_istream_t * stream,pb_istream_t * substream)398 bool checkreturn pb_close_string_substream(pb_istream_t *stream, pb_istream_t *substream)
399 {
400 if (substream->bytes_left) {
401 if (!pb_read(substream, NULL, substream->bytes_left))
402 return false;
403 }
404
405 stream->state = substream->state;
406
407 #ifndef PB_NO_ERRMSG
408 stream->errmsg = substream->errmsg;
409 #endif
410 return true;
411 }
412
413 /*************************
414 * Decode a single field *
415 *************************/
416
decode_basic_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)417 static bool checkreturn decode_basic_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
418 {
419 switch (PB_LTYPE(field->type))
420 {
421 case PB_LTYPE_BOOL:
422 if (wire_type != PB_WT_VARINT && wire_type != PB_WT_PACKED)
423 PB_RETURN_ERROR(stream, "wrong wire type");
424
425 return pb_dec_bool(stream, field);
426
427 case PB_LTYPE_VARINT:
428 case PB_LTYPE_UVARINT:
429 case PB_LTYPE_SVARINT:
430 if (wire_type != PB_WT_VARINT && wire_type != PB_WT_PACKED)
431 PB_RETURN_ERROR(stream, "wrong wire type");
432
433 return pb_dec_varint(stream, field);
434
435 case PB_LTYPE_FIXED32:
436 if (wire_type != PB_WT_32BIT && wire_type != PB_WT_PACKED)
437 PB_RETURN_ERROR(stream, "wrong wire type");
438
439 return pb_decode_fixed32(stream, field->pData);
440
441 case PB_LTYPE_FIXED64:
442 if (wire_type != PB_WT_64BIT && wire_type != PB_WT_PACKED)
443 PB_RETURN_ERROR(stream, "wrong wire type");
444
445 #ifdef PB_CONVERT_DOUBLE_FLOAT
446 if (field->data_size == sizeof(float))
447 {
448 return pb_decode_double_as_float(stream, (float*)field->pData);
449 }
450 #endif
451
452 #ifdef PB_WITHOUT_64BIT
453 PB_RETURN_ERROR(stream, "invalid data_size");
454 #else
455 return pb_decode_fixed64(stream, field->pData);
456 #endif
457
458 case PB_LTYPE_BYTES:
459 if (wire_type != PB_WT_STRING)
460 PB_RETURN_ERROR(stream, "wrong wire type");
461
462 return pb_dec_bytes(stream, field);
463
464 case PB_LTYPE_STRING:
465 if (wire_type != PB_WT_STRING)
466 PB_RETURN_ERROR(stream, "wrong wire type");
467
468 return pb_dec_string(stream, field);
469
470 case PB_LTYPE_SUBMESSAGE:
471 case PB_LTYPE_SUBMSG_W_CB:
472 if (wire_type != PB_WT_STRING)
473 PB_RETURN_ERROR(stream, "wrong wire type");
474
475 return pb_dec_submessage(stream, field);
476
477 case PB_LTYPE_FIXED_LENGTH_BYTES:
478 if (wire_type != PB_WT_STRING)
479 PB_RETURN_ERROR(stream, "wrong wire type");
480
481 return pb_dec_fixed_length_bytes(stream, field);
482
483 default:
484 PB_RETURN_ERROR(stream, "invalid field type");
485 }
486 }
487
decode_static_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)488 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
489 {
490 switch (PB_HTYPE(field->type))
491 {
492 case PB_HTYPE_REQUIRED:
493 return decode_basic_field(stream, wire_type, field);
494
495 case PB_HTYPE_OPTIONAL:
496 if (field->pSize != NULL)
497 *(bool*)field->pSize = true;
498 return decode_basic_field(stream, wire_type, field);
499
500 case PB_HTYPE_REPEATED:
501 if (wire_type == PB_WT_STRING
502 && PB_LTYPE(field->type) <= PB_LTYPE_LAST_PACKABLE)
503 {
504 /* Packed array */
505 bool status = true;
506 pb_istream_t substream;
507 pb_size_t *size = (pb_size_t*)field->pSize;
508 field->pData = (char*)field->pField + field->data_size * (*size);
509
510 if (!pb_make_string_substream(stream, &substream))
511 return false;
512
513 while (substream.bytes_left > 0 && *size < field->array_size)
514 {
515 if (!decode_basic_field(&substream, PB_WT_PACKED, field))
516 {
517 status = false;
518 break;
519 }
520 (*size)++;
521 field->pData = (char*)field->pData + field->data_size;
522 }
523
524 if (substream.bytes_left != 0)
525 PB_RETURN_ERROR(stream, "array overflow");
526 if (!pb_close_string_substream(stream, &substream))
527 return false;
528
529 return status;
530 }
531 else
532 {
533 /* Repeated field */
534 pb_size_t *size = (pb_size_t*)field->pSize;
535 field->pData = (char*)field->pField + field->data_size * (*size);
536
537 if ((*size)++ >= field->array_size)
538 PB_RETURN_ERROR(stream, "array overflow");
539
540 return decode_basic_field(stream, wire_type, field);
541 }
542
543 case PB_HTYPE_ONEOF:
544 if (PB_LTYPE_IS_SUBMSG(field->type) &&
545 *(pb_size_t*)field->pSize != field->tag)
546 {
547 /* We memset to zero so that any callbacks are set to NULL.
548 * This is because the callbacks might otherwise have values
549 * from some other union field.
550 * If callbacks are needed inside oneof field, use .proto
551 * option submsg_callback to have a separate callback function
552 * that can set the fields before submessage is decoded.
553 * pb_dec_submessage() will set any default values. */
554 memset(field->pData, 0, (size_t)field->data_size);
555
556 /* Set default values for the submessage fields. */
557 if (field->submsg_desc->default_value != NULL ||
558 field->submsg_desc->field_callback != NULL ||
559 field->submsg_desc->submsg_info[0] != NULL)
560 {
561 pb_field_iter_t submsg_iter;
562 if (pb_field_iter_begin(&submsg_iter, field->submsg_desc, field->pData))
563 {
564 if (!pb_message_set_to_defaults(&submsg_iter))
565 PB_RETURN_ERROR(stream, "failed to set defaults");
566 }
567 }
568 }
569 *(pb_size_t*)field->pSize = field->tag;
570
571 return decode_basic_field(stream, wire_type, field);
572
573 default:
574 PB_RETURN_ERROR(stream, "invalid field type");
575 }
576 }
577
578 #ifdef PB_ENABLE_MALLOC
579 /* Allocate storage for the field and store the pointer at iter->pData.
580 * array_size is the number of entries to reserve in an array.
581 * Zero size is not allowed, use pb_free() for releasing.
582 */
allocate_field(pb_istream_t * stream,void * pData,size_t data_size,size_t array_size)583 static bool checkreturn allocate_field(pb_istream_t *stream, void *pData, size_t data_size, size_t array_size)
584 {
585 void *ptr = *(void**)pData;
586
587 if (data_size == 0 || array_size == 0)
588 PB_RETURN_ERROR(stream, "invalid size");
589
590 #ifdef __AVR__
591 /* Workaround for AVR libc bug 53284: http://savannah.nongnu.org/bugs/?53284
592 * Realloc to size of 1 byte can cause corruption of the malloc structures.
593 */
594 if (data_size == 1 && array_size == 1)
595 {
596 data_size = 2;
597 }
598 #endif
599
600 /* Check for multiplication overflows.
601 * This code avoids the costly division if the sizes are small enough.
602 * Multiplication is safe as long as only half of bits are set
603 * in either multiplicand.
604 */
605 {
606 const size_t check_limit = (size_t)1 << (sizeof(size_t) * 4);
607 if (data_size >= check_limit || array_size >= check_limit)
608 {
609 const size_t size_max = (size_t)-1;
610 if (size_max / array_size < data_size)
611 {
612 PB_RETURN_ERROR(stream, "size too large");
613 }
614 }
615 }
616
617 /* Allocate new or expand previous allocation */
618 /* Note: on failure the old pointer will remain in the structure,
619 * the message must be freed by caller also on error return. */
620 ptr = pb_realloc(ptr, array_size * data_size);
621 if (ptr == NULL)
622 PB_RETURN_ERROR(stream, "realloc failed");
623
624 *(void**)pData = ptr;
625 return true;
626 }
627
628 /* Clear a newly allocated item in case it contains a pointer, or is a submessage. */
initialize_pointer_field(void * pItem,pb_field_iter_t * field)629 static void initialize_pointer_field(void *pItem, pb_field_iter_t *field)
630 {
631 if (PB_LTYPE(field->type) == PB_LTYPE_STRING ||
632 PB_LTYPE(field->type) == PB_LTYPE_BYTES)
633 {
634 *(void**)pItem = NULL;
635 }
636 else if (PB_LTYPE_IS_SUBMSG(field->type))
637 {
638 /* We memset to zero so that any callbacks are set to NULL.
639 * Default values will be set by pb_dec_submessage(). */
640 memset(pItem, 0, field->data_size);
641 }
642 }
643 #endif
644
decode_pointer_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)645 static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
646 {
647 #ifndef PB_ENABLE_MALLOC
648 PB_UNUSED(wire_type);
649 PB_UNUSED(field);
650 PB_RETURN_ERROR(stream, "no malloc support");
651 #else
652 switch (PB_HTYPE(field->type))
653 {
654 case PB_HTYPE_REQUIRED:
655 case PB_HTYPE_OPTIONAL:
656 case PB_HTYPE_ONEOF:
657 if (PB_LTYPE_IS_SUBMSG(field->type) && *(void**)field->pField != NULL)
658 {
659 /* Duplicate field, have to release the old allocation first. */
660 /* FIXME: Does this work correctly for oneofs? */
661 pb_release_single_field(field);
662 }
663
664 if (PB_HTYPE(field->type) == PB_HTYPE_ONEOF)
665 {
666 *(pb_size_t*)field->pSize = field->tag;
667 }
668
669 if (PB_LTYPE(field->type) == PB_LTYPE_STRING ||
670 PB_LTYPE(field->type) == PB_LTYPE_BYTES)
671 {
672 /* pb_dec_string and pb_dec_bytes handle allocation themselves */
673 field->pData = field->pField;
674 return decode_basic_field(stream, wire_type, field);
675 }
676 else
677 {
678 if (!allocate_field(stream, field->pField, field->data_size, 1))
679 return false;
680
681 field->pData = *(void**)field->pField;
682 initialize_pointer_field(field->pData, field);
683 return decode_basic_field(stream, wire_type, field);
684 }
685
686 case PB_HTYPE_REPEATED:
687 if (wire_type == PB_WT_STRING
688 && PB_LTYPE(field->type) <= PB_LTYPE_LAST_PACKABLE)
689 {
690 /* Packed array, multiple items come in at once. */
691 bool status = true;
692 pb_size_t *size = (pb_size_t*)field->pSize;
693 size_t allocated_size = *size;
694 pb_istream_t substream;
695
696 if (!pb_make_string_substream(stream, &substream))
697 return false;
698
699 while (substream.bytes_left)
700 {
701 if (*size == PB_SIZE_MAX)
702 {
703 #ifndef PB_NO_ERRMSG
704 stream->errmsg = "too many array entries";
705 #endif
706 status = false;
707 break;
708 }
709
710 if ((size_t)*size + 1 > allocated_size)
711 {
712 /* Allocate more storage. This tries to guess the
713 * number of remaining entries. Round the division
714 * upwards. */
715 size_t remain = (substream.bytes_left - 1) / field->data_size + 1;
716 if (remain < PB_SIZE_MAX - allocated_size)
717 allocated_size += remain;
718 else
719 allocated_size += 1;
720
721 if (!allocate_field(&substream, field->pField, field->data_size, allocated_size))
722 {
723 status = false;
724 break;
725 }
726 }
727
728 /* Decode the array entry */
729 field->pData = *(char**)field->pField + field->data_size * (*size);
730 if (field->pData == NULL)
731 {
732 /* Shouldn't happen, but satisfies static analyzers */
733 status = false;
734 break;
735 }
736 initialize_pointer_field(field->pData, field);
737 if (!decode_basic_field(&substream, PB_WT_PACKED, field))
738 {
739 status = false;
740 break;
741 }
742
743 (*size)++;
744 }
745 if (!pb_close_string_substream(stream, &substream))
746 return false;
747
748 return status;
749 }
750 else
751 {
752 /* Normal repeated field, i.e. only one item at a time. */
753 pb_size_t *size = (pb_size_t*)field->pSize;
754
755 if (*size == PB_SIZE_MAX)
756 PB_RETURN_ERROR(stream, "too many array entries");
757
758 if (!allocate_field(stream, field->pField, field->data_size, (size_t)(*size + 1)))
759 return false;
760
761 field->pData = *(char**)field->pField + field->data_size * (*size);
762 (*size)++;
763 initialize_pointer_field(field->pData, field);
764 return decode_basic_field(stream, wire_type, field);
765 }
766
767 default:
768 PB_RETURN_ERROR(stream, "invalid field type");
769 }
770 #endif
771 }
772
decode_callback_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)773 static bool checkreturn decode_callback_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
774 {
775 if (!field->descriptor->field_callback)
776 return pb_skip_field(stream, wire_type);
777
778 if (wire_type == PB_WT_STRING)
779 {
780 pb_istream_t substream;
781 size_t prev_bytes_left;
782
783 if (!pb_make_string_substream(stream, &substream))
784 return false;
785
786 do
787 {
788 prev_bytes_left = substream.bytes_left;
789 if (!field->descriptor->field_callback(&substream, NULL, field))
790 {
791 PB_SET_ERROR(stream, substream.errmsg ? substream.errmsg : "callback failed");
792 return false;
793 }
794 } while (substream.bytes_left > 0 && substream.bytes_left < prev_bytes_left);
795
796 if (!pb_close_string_substream(stream, &substream))
797 return false;
798
799 return true;
800 }
801 else
802 {
803 /* Copy the single scalar value to stack.
804 * This is required so that we can limit the stream length,
805 * which in turn allows to use same callback for packed and
806 * not-packed fields. */
807 pb_istream_t substream;
808 pb_byte_t buffer[10];
809 size_t size = sizeof(buffer);
810
811 if (!read_raw_value(stream, wire_type, buffer, &size))
812 return false;
813 substream = pb_istream_from_buffer(buffer, size);
814
815 return field->descriptor->field_callback(&substream, NULL, field);
816 }
817 }
818
decode_field(pb_istream_t * stream,pb_wire_type_t wire_type,pb_field_iter_t * field)819 static bool checkreturn decode_field(pb_istream_t *stream, pb_wire_type_t wire_type, pb_field_iter_t *field)
820 {
821 #ifdef PB_ENABLE_MALLOC
822 /* When decoding an oneof field, check if there is old data that must be
823 * released first. */
824 if (PB_HTYPE(field->type) == PB_HTYPE_ONEOF)
825 {
826 if (!pb_release_union_field(stream, field))
827 return false;
828 }
829 #endif
830
831 switch (PB_ATYPE(field->type))
832 {
833 case PB_ATYPE_STATIC:
834 return decode_static_field(stream, wire_type, field);
835
836 case PB_ATYPE_POINTER:
837 return decode_pointer_field(stream, wire_type, field);
838
839 case PB_ATYPE_CALLBACK:
840 return decode_callback_field(stream, wire_type, field);
841
842 default:
843 PB_RETURN_ERROR(stream, "invalid field type");
844 }
845 }
846
847 /* Default handler for extension fields. Expects to have a pb_msgdesc_t
848 * pointer in the extension->type->arg field, pointing to a message with
849 * only one field in it. */
default_extension_decoder(pb_istream_t * stream,pb_extension_t * extension,uint32_t tag,pb_wire_type_t wire_type)850 static bool checkreturn default_extension_decoder(pb_istream_t *stream,
851 pb_extension_t *extension, uint32_t tag, pb_wire_type_t wire_type)
852 {
853 pb_field_iter_t iter;
854
855 if (!pb_field_iter_begin_extension(&iter, extension))
856 PB_RETURN_ERROR(stream, "invalid extension");
857
858 if (iter.tag != tag || !iter.message)
859 return true;
860
861 extension->found = true;
862 return decode_field(stream, wire_type, &iter);
863 }
864
865 /* Try to decode an unknown field as an extension field. Tries each extension
866 * decoder in turn, until one of them handles the field or loop ends. */
decode_extension(pb_istream_t * stream,uint32_t tag,pb_wire_type_t wire_type,pb_extension_t * extension)867 static bool checkreturn decode_extension(pb_istream_t *stream,
868 uint32_t tag, pb_wire_type_t wire_type, pb_extension_t *extension)
869 {
870 size_t pos = stream->bytes_left;
871
872 while (extension != NULL && pos == stream->bytes_left)
873 {
874 bool status;
875 if (extension->type->decode)
876 status = extension->type->decode(stream, extension, tag, wire_type);
877 else
878 status = default_extension_decoder(stream, extension, tag, wire_type);
879
880 if (!status)
881 return false;
882
883 extension = extension->next;
884 }
885
886 return true;
887 }
888
889 /* Initialize message fields to default values, recursively */
pb_field_set_to_default(pb_field_iter_t * field)890 static bool pb_field_set_to_default(pb_field_iter_t *field)
891 {
892 pb_type_t type;
893 type = field->type;
894
895 if (PB_LTYPE(type) == PB_LTYPE_EXTENSION)
896 {
897 pb_extension_t *ext = *(pb_extension_t* const *)field->pData;
898 while (ext != NULL)
899 {
900 pb_field_iter_t ext_iter;
901 if (pb_field_iter_begin_extension(&ext_iter, ext))
902 {
903 ext->found = false;
904 if (!pb_message_set_to_defaults(&ext_iter))
905 return false;
906 }
907 ext = ext->next;
908 }
909 }
910 else if (PB_ATYPE(type) == PB_ATYPE_STATIC)
911 {
912 bool init_data = true;
913 if (PB_HTYPE(type) == PB_HTYPE_OPTIONAL && field->pSize != NULL)
914 {
915 /* Set has_field to false. Still initialize the optional field
916 * itself also. */
917 *(bool*)field->pSize = false;
918 }
919 else if (PB_HTYPE(type) == PB_HTYPE_REPEATED ||
920 PB_HTYPE(type) == PB_HTYPE_ONEOF)
921 {
922 /* REPEATED: Set array count to 0, no need to initialize contents.
923 ONEOF: Set which_field to 0. */
924 *(pb_size_t*)field->pSize = 0;
925 init_data = false;
926 }
927
928 if (init_data)
929 {
930 if (PB_LTYPE_IS_SUBMSG(field->type) &&
931 (field->submsg_desc->default_value != NULL ||
932 field->submsg_desc->field_callback != NULL ||
933 field->submsg_desc->submsg_info[0] != NULL))
934 {
935 /* Initialize submessage to defaults.
936 * Only needed if it has default values
937 * or callback/submessage fields. */
938 pb_field_iter_t submsg_iter;
939 if (pb_field_iter_begin(&submsg_iter, field->submsg_desc, field->pData))
940 {
941 if (!pb_message_set_to_defaults(&submsg_iter))
942 return false;
943 }
944 }
945 else
946 {
947 /* Initialize to zeros */
948 memset(field->pData, 0, (size_t)field->data_size);
949 }
950 }
951 }
952 else if (PB_ATYPE(type) == PB_ATYPE_POINTER)
953 {
954 /* Initialize the pointer to NULL. */
955 *(void**)field->pField = NULL;
956
957 /* Initialize array count to 0. */
958 if (PB_HTYPE(type) == PB_HTYPE_REPEATED ||
959 PB_HTYPE(type) == PB_HTYPE_ONEOF)
960 {
961 *(pb_size_t*)field->pSize = 0;
962 }
963 }
964 else if (PB_ATYPE(type) == PB_ATYPE_CALLBACK)
965 {
966 /* Don't overwrite callback */
967 }
968
969 return true;
970 }
971
pb_message_set_to_defaults(pb_field_iter_t * iter)972 static bool pb_message_set_to_defaults(pb_field_iter_t *iter)
973 {
974 pb_istream_t defstream = PB_ISTREAM_EMPTY;
975 uint32_t tag = 0;
976 pb_wire_type_t wire_type = PB_WT_VARINT;
977 bool eof;
978
979 if (iter->descriptor->default_value)
980 {
981 defstream = pb_istream_from_buffer(iter->descriptor->default_value, (size_t)-1);
982 if (!pb_decode_tag(&defstream, &wire_type, &tag, &eof))
983 return false;
984 }
985
986 do
987 {
988 if (!pb_field_set_to_default(iter))
989 return false;
990
991 if (tag != 0 && iter->tag == tag)
992 {
993 /* We have a default value for this field in the defstream */
994 if (!decode_field(&defstream, wire_type, iter))
995 return false;
996 if (!pb_decode_tag(&defstream, &wire_type, &tag, &eof))
997 return false;
998
999 if (iter->pSize)
1000 *(bool*)iter->pSize = false;
1001 }
1002 } while (pb_field_iter_next(iter));
1003
1004 return true;
1005 }
1006
1007 /*********************
1008 * Decode all fields *
1009 *********************/
1010
pb_decode_inner(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct,unsigned int flags)1011 static bool checkreturn pb_decode_inner(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct, unsigned int flags)
1012 {
1013 /* If the message contains extension fields, the extension handlers
1014 * are called when tag number is >= extension_range_start. This precheck
1015 * is just for speed, and the handlers will check for precise match.
1016 */
1017 uint32_t extension_range_start = 0;
1018 pb_extension_t *extensions = NULL;
1019
1020 /* 'fixed_count_field' and 'fixed_count_size' track position of a repeated fixed
1021 * count field. This can only handle _one_ repeated fixed count field that
1022 * is unpacked and unordered among other (non repeated fixed count) fields.
1023 */
1024 pb_size_t fixed_count_field = PB_SIZE_MAX;
1025 pb_size_t fixed_count_size = 0;
1026 pb_size_t fixed_count_total_size = 0;
1027
1028 /* Tag and wire type of next field from the input stream */
1029 uint32_t tag;
1030 pb_wire_type_t wire_type;
1031 bool eof;
1032
1033 /* Track presence of required fields */
1034 pb_fields_seen_t fields_seen = {{0, 0}};
1035 const uint32_t allbits = ~(uint32_t)0;
1036
1037 /* Descriptor for the structure field matching the tag decoded from stream */
1038 pb_field_iter_t iter;
1039
1040 if (pb_field_iter_begin(&iter, fields, dest_struct))
1041 {
1042 if ((flags & PB_DECODE_NOINIT) == 0)
1043 {
1044 if (!pb_message_set_to_defaults(&iter))
1045 PB_RETURN_ERROR(stream, "failed to set defaults");
1046 }
1047 }
1048
1049 while (pb_decode_tag(stream, &wire_type, &tag, &eof))
1050 {
1051 if (tag == 0)
1052 {
1053 if (flags & PB_DECODE_NULLTERMINATED)
1054 {
1055 eof = true;
1056 break;
1057 }
1058 else
1059 {
1060 PB_RETURN_ERROR(stream, "zero tag");
1061 }
1062 }
1063
1064 if (!pb_field_iter_find(&iter, tag) || PB_LTYPE(iter.type) == PB_LTYPE_EXTENSION)
1065 {
1066 /* No match found, check if it matches an extension. */
1067 if (extension_range_start == 0)
1068 {
1069 if (pb_field_iter_find_extension(&iter))
1070 {
1071 extensions = *(pb_extension_t* const *)iter.pData;
1072 extension_range_start = iter.tag;
1073 }
1074
1075 if (!extensions)
1076 {
1077 extension_range_start = (uint32_t)-1;
1078 }
1079 }
1080
1081 if (tag >= extension_range_start)
1082 {
1083 size_t pos = stream->bytes_left;
1084
1085 if (!decode_extension(stream, tag, wire_type, extensions))
1086 return false;
1087
1088 if (pos != stream->bytes_left)
1089 {
1090 /* The field was handled */
1091 continue;
1092 }
1093 }
1094
1095 /* No match found, skip data */
1096 if (!pb_skip_field(stream, wire_type))
1097 return false;
1098 continue;
1099 }
1100
1101 /* If a repeated fixed count field was found, get size from
1102 * 'fixed_count_field' as there is no counter contained in the struct.
1103 */
1104 if (PB_HTYPE(iter.type) == PB_HTYPE_REPEATED && iter.pSize == &iter.array_size)
1105 {
1106 if (fixed_count_field != iter.index) {
1107 /* If the new fixed count field does not match the previous one,
1108 * check that the previous one is NULL or that it finished
1109 * receiving all the expected data.
1110 */
1111 if (fixed_count_field != PB_SIZE_MAX &&
1112 fixed_count_size != fixed_count_total_size)
1113 {
1114 PB_RETURN_ERROR(stream, "wrong size for fixed count field");
1115 }
1116
1117 fixed_count_field = iter.index;
1118 fixed_count_size = 0;
1119 fixed_count_total_size = iter.array_size;
1120 }
1121
1122 iter.pSize = &fixed_count_size;
1123 }
1124
1125 if (PB_HTYPE(iter.type) == PB_HTYPE_REQUIRED
1126 && iter.required_field_index < PB_MAX_REQUIRED_FIELDS)
1127 {
1128 uint32_t tmp = ((uint32_t)1 << (iter.required_field_index & 31));
1129 fields_seen.bitfield[iter.required_field_index >> 5] |= tmp;
1130 }
1131
1132 if (!decode_field(stream, wire_type, &iter))
1133 return false;
1134 }
1135
1136 if (!eof)
1137 {
1138 /* pb_decode_tag() returned error before end of stream */
1139 return false;
1140 }
1141
1142 /* Check that all elements of the last decoded fixed count field were present. */
1143 if (fixed_count_field != PB_SIZE_MAX &&
1144 fixed_count_size != fixed_count_total_size)
1145 {
1146 PB_RETURN_ERROR(stream, "wrong size for fixed count field");
1147 }
1148
1149 /* Check that all required fields were present. */
1150 {
1151 pb_size_t req_field_count = iter.descriptor->required_field_count;
1152
1153 if (req_field_count > 0)
1154 {
1155 pb_size_t i;
1156
1157 if (req_field_count > PB_MAX_REQUIRED_FIELDS)
1158 req_field_count = PB_MAX_REQUIRED_FIELDS;
1159
1160 /* Check the whole words */
1161 for (i = 0; i < (req_field_count >> 5); i++)
1162 {
1163 if (fields_seen.bitfield[i] != allbits)
1164 PB_RETURN_ERROR(stream, "missing required field");
1165 }
1166
1167 /* Check the remaining bits (if any) */
1168 if ((req_field_count & 31) != 0)
1169 {
1170 if (fields_seen.bitfield[req_field_count >> 5] !=
1171 (allbits >> (uint_least8_t)(32 - (req_field_count & 31))))
1172 {
1173 PB_RETURN_ERROR(stream, "missing required field");
1174 }
1175 }
1176 }
1177 }
1178
1179 return true;
1180 }
1181
pb_decode_ex(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct,unsigned int flags)1182 bool checkreturn pb_decode_ex(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct, unsigned int flags)
1183 {
1184 bool status;
1185
1186 if ((flags & PB_DECODE_DELIMITED) == 0)
1187 {
1188 status = pb_decode_inner(stream, fields, dest_struct, flags);
1189 }
1190 else
1191 {
1192 pb_istream_t substream;
1193 if (!pb_make_string_substream(stream, &substream))
1194 return false;
1195
1196 status = pb_decode_inner(&substream, fields, dest_struct, flags);
1197
1198 if (!pb_close_string_substream(stream, &substream))
1199 status = false;
1200 }
1201
1202 #ifdef PB_ENABLE_MALLOC
1203 if (!status)
1204 pb_release(fields, dest_struct);
1205 #endif
1206
1207 return status;
1208 }
1209
pb_decode(pb_istream_t * stream,const pb_msgdesc_t * fields,void * dest_struct)1210 bool checkreturn pb_decode(pb_istream_t *stream, const pb_msgdesc_t *fields, void *dest_struct)
1211 {
1212 return pb_decode_ex(stream, fields, dest_struct, 0);
1213 }
1214
1215 #ifdef PB_ENABLE_MALLOC
1216 /* Given an oneof field, if there has already been a field inside this oneof,
1217 * release it before overwriting with a different one. */
pb_release_union_field(pb_istream_t * stream,pb_field_iter_t * field)1218 static bool pb_release_union_field(pb_istream_t *stream, pb_field_iter_t *field)
1219 {
1220 pb_field_iter_t old_field = *field;
1221 pb_size_t old_tag = *(pb_size_t*)field->pSize; /* Previous which_ value */
1222 pb_size_t new_tag = field->tag; /* New which_ value */
1223
1224 if (old_tag == 0)
1225 return true; /* Ok, no old data in union */
1226
1227 if (old_tag == new_tag)
1228 return true; /* Ok, old data is of same type => merge */
1229
1230 /* Release old data. The find can fail if the message struct contains
1231 * invalid data. */
1232 if (!pb_field_iter_find(&old_field, old_tag))
1233 PB_RETURN_ERROR(stream, "invalid union tag");
1234
1235 pb_release_single_field(&old_field);
1236
1237 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1238 {
1239 /* Initialize the pointer to NULL to make sure it is valid
1240 * even in case of error return. */
1241 *(void**)field->pField = NULL;
1242 field->pData = NULL;
1243 }
1244
1245 return true;
1246 }
1247
pb_release_single_field(pb_field_iter_t * field)1248 static void pb_release_single_field(pb_field_iter_t *field)
1249 {
1250 pb_type_t type;
1251 type = field->type;
1252
1253 if (PB_HTYPE(type) == PB_HTYPE_ONEOF)
1254 {
1255 if (*(pb_size_t*)field->pSize != field->tag)
1256 return; /* This is not the current field in the union */
1257 }
1258
1259 /* Release anything contained inside an extension or submsg.
1260 * This has to be done even if the submsg itself is statically
1261 * allocated. */
1262 if (PB_LTYPE(type) == PB_LTYPE_EXTENSION)
1263 {
1264 /* Release fields from all extensions in the linked list */
1265 pb_extension_t *ext = *(pb_extension_t**)field->pData;
1266 while (ext != NULL)
1267 {
1268 pb_field_iter_t ext_iter;
1269 if (pb_field_iter_begin_extension(&ext_iter, ext))
1270 {
1271 pb_release_single_field(&ext_iter);
1272 }
1273 ext = ext->next;
1274 }
1275 }
1276 else if (PB_LTYPE_IS_SUBMSG(type) && PB_ATYPE(type) != PB_ATYPE_CALLBACK)
1277 {
1278 /* Release fields in submessage or submsg array */
1279 pb_size_t count = 1;
1280
1281 if (PB_ATYPE(type) == PB_ATYPE_POINTER)
1282 {
1283 field->pData = *(void**)field->pField;
1284 }
1285 else
1286 {
1287 field->pData = field->pField;
1288 }
1289
1290 if (PB_HTYPE(type) == PB_HTYPE_REPEATED)
1291 {
1292 count = *(pb_size_t*)field->pSize;
1293
1294 if (PB_ATYPE(type) == PB_ATYPE_STATIC && count > field->array_size)
1295 {
1296 /* Protect against corrupted _count fields */
1297 count = field->array_size;
1298 }
1299 }
1300
1301 if (field->pData)
1302 {
1303 for (; count > 0; count--)
1304 {
1305 pb_release(field->submsg_desc, field->pData);
1306 field->pData = (char*)field->pData + field->data_size;
1307 }
1308 }
1309 }
1310
1311 if (PB_ATYPE(type) == PB_ATYPE_POINTER)
1312 {
1313 if (PB_HTYPE(type) == PB_HTYPE_REPEATED &&
1314 (PB_LTYPE(type) == PB_LTYPE_STRING ||
1315 PB_LTYPE(type) == PB_LTYPE_BYTES))
1316 {
1317 /* Release entries in repeated string or bytes array */
1318 void **pItem = *(void***)field->pField;
1319 pb_size_t count = *(pb_size_t*)field->pSize;
1320 for (; count > 0; count--)
1321 {
1322 pb_free(*pItem);
1323 *pItem++ = NULL;
1324 }
1325 }
1326
1327 if (PB_HTYPE(type) == PB_HTYPE_REPEATED)
1328 {
1329 /* We are going to release the array, so set the size to 0 */
1330 *(pb_size_t*)field->pSize = 0;
1331 }
1332
1333 /* Release main pointer */
1334 pb_free(*(void**)field->pField);
1335 *(void**)field->pField = NULL;
1336 }
1337 }
1338
pb_release(const pb_msgdesc_t * fields,void * dest_struct)1339 void pb_release(const pb_msgdesc_t *fields, void *dest_struct)
1340 {
1341 pb_field_iter_t iter;
1342
1343 if (!dest_struct)
1344 return; /* Ignore NULL pointers, similar to free() */
1345
1346 if (!pb_field_iter_begin(&iter, fields, dest_struct))
1347 return; /* Empty message type */
1348
1349 do
1350 {
1351 pb_release_single_field(&iter);
1352 } while (pb_field_iter_next(&iter));
1353 }
1354 #else
pb_release(const pb_msgdesc_t * fields,void * dest_struct)1355 void pb_release(const pb_msgdesc_t *fields, void *dest_struct)
1356 {
1357 /* Nothing to release without PB_ENABLE_MALLOC. */
1358 PB_UNUSED(fields);
1359 PB_UNUSED(dest_struct);
1360 }
1361 #endif
1362
1363 /* Field decoders */
1364
pb_decode_bool(pb_istream_t * stream,bool * dest)1365 bool pb_decode_bool(pb_istream_t *stream, bool *dest)
1366 {
1367 uint32_t value;
1368 if (!pb_decode_varint32(stream, &value))
1369 return false;
1370
1371 *(bool*)dest = (value != 0);
1372 return true;
1373 }
1374
pb_decode_svarint(pb_istream_t * stream,pb_int64_t * dest)1375 bool pb_decode_svarint(pb_istream_t *stream, pb_int64_t *dest)
1376 {
1377 pb_uint64_t value;
1378 if (!pb_decode_varint(stream, &value))
1379 return false;
1380
1381 if (value & 1)
1382 *dest = (pb_int64_t)(~(value >> 1));
1383 else
1384 *dest = (pb_int64_t)(value >> 1);
1385
1386 return true;
1387 }
1388
pb_decode_fixed32(pb_istream_t * stream,void * dest)1389 bool pb_decode_fixed32(pb_istream_t *stream, void *dest)
1390 {
1391 union {
1392 uint32_t fixed32;
1393 pb_byte_t bytes[4];
1394 } u;
1395
1396 if (!pb_read(stream, u.bytes, 4))
1397 return false;
1398
1399 #if defined(PB_LITTLE_ENDIAN_8BIT) && PB_LITTLE_ENDIAN_8BIT == 1
1400 /* fast path - if we know that we're on little endian, assign directly */
1401 *(uint32_t*)dest = u.fixed32;
1402 #else
1403 *(uint32_t*)dest = ((uint32_t)u.bytes[0] << 0) |
1404 ((uint32_t)u.bytes[1] << 8) |
1405 ((uint32_t)u.bytes[2] << 16) |
1406 ((uint32_t)u.bytes[3] << 24);
1407 #endif
1408 return true;
1409 }
1410
1411 #ifndef PB_WITHOUT_64BIT
pb_decode_fixed64(pb_istream_t * stream,void * dest)1412 bool pb_decode_fixed64(pb_istream_t *stream, void *dest)
1413 {
1414 union {
1415 uint64_t fixed64;
1416 pb_byte_t bytes[8];
1417 } u;
1418
1419 if (!pb_read(stream, u.bytes, 8))
1420 return false;
1421
1422 #if defined(PB_LITTLE_ENDIAN_8BIT) && PB_LITTLE_ENDIAN_8BIT == 1
1423 /* fast path - if we know that we're on little endian, assign directly */
1424 *(uint64_t*)dest = u.fixed64;
1425 #else
1426 *(uint64_t*)dest = ((uint64_t)u.bytes[0] << 0) |
1427 ((uint64_t)u.bytes[1] << 8) |
1428 ((uint64_t)u.bytes[2] << 16) |
1429 ((uint64_t)u.bytes[3] << 24) |
1430 ((uint64_t)u.bytes[4] << 32) |
1431 ((uint64_t)u.bytes[5] << 40) |
1432 ((uint64_t)u.bytes[6] << 48) |
1433 ((uint64_t)u.bytes[7] << 56);
1434 #endif
1435 return true;
1436 }
1437 #endif
1438
pb_dec_bool(pb_istream_t * stream,const pb_field_iter_t * field)1439 static bool checkreturn pb_dec_bool(pb_istream_t *stream, const pb_field_iter_t *field)
1440 {
1441 return pb_decode_bool(stream, (bool*)field->pData);
1442 }
1443
pb_dec_varint(pb_istream_t * stream,const pb_field_iter_t * field)1444 static bool checkreturn pb_dec_varint(pb_istream_t *stream, const pb_field_iter_t *field)
1445 {
1446 if (PB_LTYPE(field->type) == PB_LTYPE_UVARINT)
1447 {
1448 pb_uint64_t value, clamped;
1449 if (!pb_decode_varint(stream, &value))
1450 return false;
1451
1452 /* Cast to the proper field size, while checking for overflows */
1453 if (field->data_size == sizeof(pb_uint64_t))
1454 clamped = *(pb_uint64_t*)field->pData = value;
1455 else if (field->data_size == sizeof(uint32_t))
1456 clamped = *(uint32_t*)field->pData = (uint32_t)value;
1457 else if (field->data_size == sizeof(uint_least16_t))
1458 clamped = *(uint_least16_t*)field->pData = (uint_least16_t)value;
1459 else if (field->data_size == sizeof(uint_least8_t))
1460 clamped = *(uint_least8_t*)field->pData = (uint_least8_t)value;
1461 else
1462 PB_RETURN_ERROR(stream, "invalid data_size");
1463
1464 if (clamped != value)
1465 PB_RETURN_ERROR(stream, "integer too large");
1466
1467 return true;
1468 }
1469 else
1470 {
1471 pb_uint64_t value;
1472 pb_int64_t svalue;
1473 pb_int64_t clamped;
1474
1475 if (PB_LTYPE(field->type) == PB_LTYPE_SVARINT)
1476 {
1477 if (!pb_decode_svarint(stream, &svalue))
1478 return false;
1479 }
1480 else
1481 {
1482 if (!pb_decode_varint(stream, &value))
1483 return false;
1484
1485 /* See issue 97: Google's C++ protobuf allows negative varint values to
1486 * be cast as int32_t, instead of the int64_t that should be used when
1487 * encoding. Nanopb versions before 0.2.5 had a bug in encoding. In order to
1488 * not break decoding of such messages, we cast <=32 bit fields to
1489 * int32_t first to get the sign correct.
1490 */
1491 if (field->data_size == sizeof(pb_int64_t))
1492 svalue = (pb_int64_t)value;
1493 else
1494 svalue = (int32_t)value;
1495 }
1496
1497 /* Cast to the proper field size, while checking for overflows */
1498 if (field->data_size == sizeof(pb_int64_t))
1499 clamped = *(pb_int64_t*)field->pData = svalue;
1500 else if (field->data_size == sizeof(int32_t))
1501 clamped = *(int32_t*)field->pData = (int32_t)svalue;
1502 else if (field->data_size == sizeof(int_least16_t))
1503 clamped = *(int_least16_t*)field->pData = (int_least16_t)svalue;
1504 else if (field->data_size == sizeof(int_least8_t))
1505 clamped = *(int_least8_t*)field->pData = (int_least8_t)svalue;
1506 else
1507 PB_RETURN_ERROR(stream, "invalid data_size");
1508
1509 if (clamped != svalue)
1510 PB_RETURN_ERROR(stream, "integer too large");
1511
1512 return true;
1513 }
1514 }
1515
pb_dec_bytes(pb_istream_t * stream,const pb_field_iter_t * field)1516 static bool checkreturn pb_dec_bytes(pb_istream_t *stream, const pb_field_iter_t *field)
1517 {
1518 uint32_t size;
1519 size_t alloc_size;
1520 pb_bytes_array_t *dest;
1521
1522 if (!pb_decode_varint32(stream, &size))
1523 return false;
1524
1525 if (size > PB_SIZE_MAX)
1526 PB_RETURN_ERROR(stream, "bytes overflow");
1527
1528 alloc_size = PB_BYTES_ARRAY_T_ALLOCSIZE(size);
1529 if (size > alloc_size)
1530 PB_RETURN_ERROR(stream, "size too large");
1531
1532 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1533 {
1534 #ifndef PB_ENABLE_MALLOC
1535 PB_RETURN_ERROR(stream, "no malloc support");
1536 #else
1537 if (stream->bytes_left < size)
1538 PB_RETURN_ERROR(stream, "end-of-stream");
1539
1540 if (!allocate_field(stream, field->pData, alloc_size, 1))
1541 return false;
1542 dest = *(pb_bytes_array_t**)field->pData;
1543 #endif
1544 }
1545 else
1546 {
1547 if (alloc_size > field->data_size)
1548 PB_RETURN_ERROR(stream, "bytes overflow");
1549 dest = (pb_bytes_array_t*)field->pData;
1550 }
1551
1552 dest->size = (pb_size_t)size;
1553 return pb_read(stream, dest->bytes, (size_t)size);
1554 }
1555
pb_dec_string(pb_istream_t * stream,const pb_field_iter_t * field)1556 static bool checkreturn pb_dec_string(pb_istream_t *stream, const pb_field_iter_t *field)
1557 {
1558 uint32_t size;
1559 size_t alloc_size;
1560 pb_byte_t *dest = (pb_byte_t*)field->pData;
1561
1562 if (!pb_decode_varint32(stream, &size))
1563 return false;
1564
1565 if (size == (uint32_t)-1)
1566 PB_RETURN_ERROR(stream, "size too large");
1567
1568 /* Space for null terminator */
1569 alloc_size = (size_t)(size + 1);
1570
1571 if (alloc_size < size)
1572 PB_RETURN_ERROR(stream, "size too large");
1573
1574 if (PB_ATYPE(field->type) == PB_ATYPE_POINTER)
1575 {
1576 #ifndef PB_ENABLE_MALLOC
1577 PB_RETURN_ERROR(stream, "no malloc support");
1578 #else
1579 if (stream->bytes_left < size)
1580 PB_RETURN_ERROR(stream, "end-of-stream");
1581
1582 if (!allocate_field(stream, field->pData, alloc_size, 1))
1583 return false;
1584 dest = *(pb_byte_t**)field->pData;
1585 #endif
1586 }
1587 else
1588 {
1589 if (alloc_size > field->data_size)
1590 PB_RETURN_ERROR(stream, "string overflow");
1591 }
1592
1593 dest[size] = 0;
1594
1595 if (!pb_read(stream, dest, (size_t)size))
1596 return false;
1597
1598 #ifdef PB_VALIDATE_UTF8
1599 if (!pb_validate_utf8((const char*)dest))
1600 PB_RETURN_ERROR(stream, "invalid utf8");
1601 #endif
1602
1603 return true;
1604 }
1605
pb_dec_submessage(pb_istream_t * stream,const pb_field_iter_t * field)1606 static bool checkreturn pb_dec_submessage(pb_istream_t *stream, const pb_field_iter_t *field)
1607 {
1608 bool status = true;
1609 bool submsg_consumed = false;
1610 pb_istream_t substream;
1611
1612 if (!pb_make_string_substream(stream, &substream))
1613 return false;
1614
1615 if (field->submsg_desc == NULL)
1616 PB_RETURN_ERROR(stream, "invalid field descriptor");
1617
1618 /* Submessages can have a separate message-level callback that is called
1619 * before decoding the message. Typically it is used to set callback fields
1620 * inside oneofs. */
1621 if (PB_LTYPE(field->type) == PB_LTYPE_SUBMSG_W_CB && field->pSize != NULL)
1622 {
1623 /* Message callback is stored right before pSize. */
1624 pb_callback_t *callback = (pb_callback_t*)field->pSize - 1;
1625 if (callback->funcs.decode)
1626 {
1627 status = callback->funcs.decode(&substream, field, &callback->arg);
1628
1629 if (substream.bytes_left == 0)
1630 {
1631 submsg_consumed = true;
1632 }
1633 }
1634 }
1635
1636 /* Now decode the submessage contents */
1637 if (status && !submsg_consumed)
1638 {
1639 unsigned int flags = 0;
1640
1641 /* Static required/optional fields are already initialized by top-level
1642 * pb_decode(), no need to initialize them again. */
1643 if (PB_ATYPE(field->type) == PB_ATYPE_STATIC &&
1644 PB_HTYPE(field->type) != PB_HTYPE_REPEATED)
1645 {
1646 flags = PB_DECODE_NOINIT;
1647 }
1648
1649 status = pb_decode_inner(&substream, field->submsg_desc, field->pData, flags);
1650 }
1651
1652 if (!pb_close_string_substream(stream, &substream))
1653 return false;
1654
1655 return status;
1656 }
1657
pb_dec_fixed_length_bytes(pb_istream_t * stream,const pb_field_iter_t * field)1658 static bool checkreturn pb_dec_fixed_length_bytes(pb_istream_t *stream, const pb_field_iter_t *field)
1659 {
1660 uint32_t size;
1661
1662 if (!pb_decode_varint32(stream, &size))
1663 return false;
1664
1665 if (size > PB_SIZE_MAX)
1666 PB_RETURN_ERROR(stream, "bytes overflow");
1667
1668 if (size == 0)
1669 {
1670 /* As a special case, treat empty bytes string as all zeros for fixed_length_bytes. */
1671 memset(field->pData, 0, (size_t)field->data_size);
1672 return true;
1673 }
1674
1675 if (size != field->data_size)
1676 PB_RETURN_ERROR(stream, "incorrect fixed length bytes size");
1677
1678 return pb_read(stream, (pb_byte_t*)field->pData, (size_t)field->data_size);
1679 }
1680
1681 #ifdef PB_CONVERT_DOUBLE_FLOAT
pb_decode_double_as_float(pb_istream_t * stream,float * dest)1682 bool pb_decode_double_as_float(pb_istream_t *stream, float *dest)
1683 {
1684 uint_least8_t sign;
1685 int exponent;
1686 uint32_t mantissa;
1687 uint64_t value;
1688 union { float f; uint32_t i; } out;
1689
1690 if (!pb_decode_fixed64(stream, &value))
1691 return false;
1692
1693 /* Decompose input value */
1694 sign = (uint_least8_t)((value >> 63) & 1);
1695 exponent = (int)((value >> 52) & 0x7FF) - 1023;
1696 mantissa = (value >> 28) & 0xFFFFFF; /* Highest 24 bits */
1697
1698 /* Figure if value is in range representable by floats. */
1699 if (exponent == 1024)
1700 {
1701 /* Special value */
1702 exponent = 128;
1703 mantissa >>= 1;
1704 }
1705 else
1706 {
1707 if (exponent > 127)
1708 {
1709 /* Too large, convert to infinity */
1710 exponent = 128;
1711 mantissa = 0;
1712 }
1713 else if (exponent < -150)
1714 {
1715 /* Too small, convert to zero */
1716 exponent = -127;
1717 mantissa = 0;
1718 }
1719 else if (exponent < -126)
1720 {
1721 /* Denormalized */
1722 mantissa |= 0x1000000;
1723 mantissa >>= (-126 - exponent);
1724 exponent = -127;
1725 }
1726
1727 /* Round off mantissa */
1728 mantissa = (mantissa + 1) >> 1;
1729
1730 /* Check if mantissa went over 2.0 */
1731 if (mantissa & 0x800000)
1732 {
1733 exponent += 1;
1734 mantissa &= 0x7FFFFF;
1735 mantissa >>= 1;
1736 }
1737 }
1738
1739 /* Combine fields */
1740 out.i = mantissa;
1741 out.i |= (uint32_t)(exponent + 127) << 23;
1742 out.i |= (uint32_t)sign << 31;
1743
1744 *dest = out.f;
1745 return true;
1746 }
1747 #endif
1748
