[mobin2021]

Summary

Guards against an unhandled hardware integer division by zero (CWE-369 / SIGFPE) in VerifierTemplate::VerifyVectorOrString.

Root Cause

In include/flatbuffers/verifier.h:155, when elem_size == 0, const auto max_elems = opts_.max_size / elem_size; executes integer division by zero. On x86/ARM hardware, this triggers an unhandled CPU #DE (Divide Error) interrupt, which aborts the host process with SIGFPE (Linux) / 0xC0000094 (Windows).

In the dynamic reflection subsystem (src/reflection.cpp:59), VerifyVectorOfStructs passes obj.bytesize() directly into VerifyVectorOrString without verifying positivity. Furthermore, reflection::VerifySchemaBuffer (reflection_generated.h:898) verifies scalar buffer bounds but does not enforce bytesize > 0 for struct objects. Consequently, a binary schema (.bfbs) with a struct of bytesize = 0 passes schema verification as valid, and subsequent verification via flatbuffers::Verify() crashes the process.

This breaches the Verifier contract, which mandates that invalid or malformed data return false rather than causing an uncatchable process crash.

Fix

1. In include/flatbuffers/verifier.h: Add invariant check if (!Check(elem_size > 0)) return false; before division.
2. In src/reflection.cpp: Add defensive check if (obj.bytesize() <= 0) return false; in VerifyVectorOfStructs.

Verification

Verified against a standalone test harness: with the patch applied, malformed struct dimensions are gracefully rejected (false) without hardware faults.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.