diff --git a/0001-Prevent-OOM-kills-on-corrupted-data.patch b/0001-Prevent-OOM-kills-on-corrupted-data.patch new file mode 100644 index 0000000000000000000000000000000000000000..428061385af32e98bc7b192c7614cd4009a3cd0f --- /dev/null +++ b/0001-Prevent-OOM-kills-on-corrupted-data.patch @@ -0,0 +1,37 @@ +From 0cb13436abbf86b989f6233ff0b22fe4017cb114 Mon Sep 17 00:00:00 2001 +From: gupengcheng0401 +Date: Wed, 13 Aug 2025 12:55:46 +0800 +Subject: [PATCH] Prevent OOM kills on corrupted data + +--- + src/idl_gen_go.cpp | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/src/idl_gen_go.cpp b/src/idl_gen_go.cpp +index 6bbc5dc8..12f0a412 100644 +--- a/src/idl_gen_go.cpp ++++ b/src/idl_gen_go.cpp +@@ -1242,6 +1242,20 @@ class GoGenerator : public BaseGenerator { + code += "\tt." + field_field + " = rcv." + field_field + "Bytes()\n"; + } else if (IsVector(field.value.type)) { + code += "\t" + length + " := rcv." + field_field + "Length()\n"; ++ // Ensure that the array size is not larger than the total data size. ++ // This is necessary to prevent OOM kills on corrupted data in the ++ // next make expression. This is the only case of corrupted data ++ // that can't be handled using recover (construction of elements ++ // should panic later, but it's already too late). The check is ++ // conservative, but it at least ensures that the allocation size ++ // is proportional to the data size. In particular, if the user code ++ // has sanity checked data size when reading from network/file, ++ // we shouldn't do allocations larger than that. ++ code += "\tif " + length + " > len(rcv._tab.Bytes)/" + ++ NumToString(InlineSize(field.value.type.VectorType())) + ++ " {\n"; ++ code += "\t\tpanic(\"bad array size\")\n"; ++ code += "\t}\n"; + code += "\tt." + field_field + " = make(" + + NativeType(field.value.type) + ", " + length + ")\n"; + code += "\tfor j := 0; j < " + length + "; j++ {\n"; +-- +2.43.0.windows.1 + diff --git a/flatbuffers.spec b/flatbuffers.spec index c4f85e82bf95f17672db215e67c8c0f2e7a846f0..5b7102fae56ad4e07fe016309fda52c0edf45314 100644 --- a/flatbuffers.spec +++ b/flatbuffers.spec @@ -2,13 +2,14 @@ Name: flatbuffers Version: 25.2.10 -Release: 1 +Release: 2 Summary: Memory efficient serialization library License: Apache-2.0 URL: https://github.com/google/flatbuffers Source0: https://github.com/google/flatbuffers/archive/v%{version}/%{name}-%{version}.tar.gz Source1: flatc.1 +Patch0: 0001-Prevent-OOM-kills-on-corrupted-data.patch BuildRequires: gcc-c++ cmake >= 2.8.9 BuildRequires: ninja-build BuildRequires: python3-devel @@ -133,6 +134,9 @@ cp -p %SOURCE1 %{buildroot}%{_mandir}/man1/flatc.1 %changelog +* Wed Aug 13 2025 gupengcheng - 25.2.10-2 +- Prevent OOM kills on corrupted data + * Tue Jun 17 2025 yaoxin <1024769339@qq.com> - 25.2.10-1 - Update to 25.2.10 for fix failure