GPBCodedInputStream.m 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503
  1. // Protocol Buffers - Google's data interchange format
  2. // Copyright 2008 Google Inc. All rights reserved.
  3. //
  4. // Use of this source code is governed by a BSD-style
  5. // license that can be found in the LICENSE file or at
  6. // https://developers.google.com/open-source/licenses/bsd
  7. #import "GPBCodedInputStream_PackagePrivate.h"
  8. #import "GPBDictionary_PackagePrivate.h"
  9. #import "GPBMessage_PackagePrivate.h"
  10. #import "GPBUnknownFieldSet_PackagePrivate.h"
  11. #import "GPBUtilities_PackagePrivate.h"
  12. #import "GPBWireFormat.h"
  13. NSString *const GPBCodedInputStreamException = GPBNSStringifySymbol(GPBCodedInputStreamException);
  14. NSString *const GPBCodedInputStreamUnderlyingErrorKey =
  15. GPBNSStringifySymbol(GPBCodedInputStreamUnderlyingErrorKey);
  16. NSString *const GPBCodedInputStreamErrorDomain =
  17. GPBNSStringifySymbol(GPBCodedInputStreamErrorDomain);
  18. // Matching:
  19. // https://github.com/protocolbuffers/protobuf/blob/main/java/core/src/main/java/com/google/protobuf/CodedInputStream.java#L62
  20. // private static final int DEFAULT_RECURSION_LIMIT = 100;
  21. // https://github.com/protocolbuffers/protobuf/blob/main/src/google/protobuf/io/coded_stream.cc#L86
  22. // int CodedInputStream::default_recursion_limit_ = 100;
  23. static const NSUInteger kDefaultRecursionLimit = 100;
  24. static void RaiseException(NSInteger code, NSString *reason) {
  25. NSDictionary *errorInfo = nil;
  26. if ([reason length]) {
  27. errorInfo = @{GPBErrorReasonKey : reason};
  28. }
  29. NSError *error = [NSError errorWithDomain:GPBCodedInputStreamErrorDomain
  30. code:code
  31. userInfo:errorInfo];
  32. NSDictionary *exceptionInfo = @{GPBCodedInputStreamUnderlyingErrorKey : error};
  33. [[NSException exceptionWithName:GPBCodedInputStreamException reason:reason
  34. userInfo:exceptionInfo] raise];
  35. }
  36. GPB_INLINE void CheckRecursionLimit(GPBCodedInputStreamState *state) {
  37. if (state->recursionDepth >= kDefaultRecursionLimit) {
  38. RaiseException(GPBCodedInputStreamErrorRecursionDepthExceeded, nil);
  39. }
  40. }
  41. GPB_INLINE void CheckFieldSize(uint64_t size) {
  42. // Bytes and Strings have a max size of 2GB. And since messages are on the wire as bytes/length
  43. // delimited, they also have a 2GB size limit. The C++ does the same sort of enforcement (see
  44. // parse_context, delimited_message_util, message_lite, etc.).
  45. // https://protobuf.dev/programming-guides/encoding/#cheat-sheet
  46. if (size > 0x7fffffff) {
  47. // TODO: Maybe a different error code for this, but adding one is a breaking
  48. // change so reuse an existing one.
  49. RaiseException(GPBCodedInputStreamErrorInvalidSize, nil);
  50. }
  51. }
  52. static void CheckSize(GPBCodedInputStreamState *state, size_t size) {
  53. size_t newSize = state->bufferPos + size;
  54. if (newSize > state->bufferSize) {
  55. RaiseException(GPBCodedInputStreamErrorInvalidSize, nil);
  56. }
  57. if (newSize > state->currentLimit) {
  58. // Fast forward to end of currentLimit;
  59. state->bufferPos = state->currentLimit;
  60. RaiseException(GPBCodedInputStreamErrorSubsectionLimitReached, nil);
  61. }
  62. }
  63. static int8_t ReadRawByte(GPBCodedInputStreamState *state) {
  64. CheckSize(state, sizeof(int8_t));
  65. return ((int8_t *)state->bytes)[state->bufferPos++];
  66. }
  67. static int32_t ReadRawLittleEndian32(GPBCodedInputStreamState *state) {
  68. CheckSize(state, sizeof(int32_t));
  69. // Not using OSReadLittleInt32 because it has undocumented dependency
  70. // on reads being aligned.
  71. int32_t value;
  72. memcpy(&value, state->bytes + state->bufferPos, sizeof(int32_t));
  73. value = OSSwapLittleToHostInt32(value);
  74. state->bufferPos += sizeof(int32_t);
  75. return value;
  76. }
  77. static int64_t ReadRawLittleEndian64(GPBCodedInputStreamState *state) {
  78. CheckSize(state, sizeof(int64_t));
  79. // Not using OSReadLittleInt64 because it has undocumented dependency
  80. // on reads being aligned.
  81. int64_t value;
  82. memcpy(&value, state->bytes + state->bufferPos, sizeof(int64_t));
  83. value = OSSwapLittleToHostInt64(value);
  84. state->bufferPos += sizeof(int64_t);
  85. return value;
  86. }
  87. static int64_t ReadRawVarint64(GPBCodedInputStreamState *state) {
  88. int32_t shift = 0;
  89. int64_t result = 0;
  90. while (shift < 64) {
  91. int8_t b = ReadRawByte(state);
  92. result |= (int64_t)((uint64_t)(b & 0x7F) << shift);
  93. if ((b & 0x80) == 0) {
  94. return result;
  95. }
  96. shift += 7;
  97. }
  98. RaiseException(GPBCodedInputStreamErrorInvalidVarInt, @"Invalid VarInt64");
  99. return 0;
  100. }
  101. static int32_t ReadRawVarint32(GPBCodedInputStreamState *state) {
  102. return (int32_t)ReadRawVarint64(state);
  103. }
  104. static void SkipRawData(GPBCodedInputStreamState *state, size_t size) {
  105. CheckSize(state, size);
  106. state->bufferPos += size;
  107. }
  108. double GPBCodedInputStreamReadDouble(GPBCodedInputStreamState *state) {
  109. int64_t value = ReadRawLittleEndian64(state);
  110. return GPBConvertInt64ToDouble(value);
  111. }
  112. float GPBCodedInputStreamReadFloat(GPBCodedInputStreamState *state) {
  113. int32_t value = ReadRawLittleEndian32(state);
  114. return GPBConvertInt32ToFloat(value);
  115. }
  116. uint64_t GPBCodedInputStreamReadUInt64(GPBCodedInputStreamState *state) {
  117. uint64_t value = ReadRawVarint64(state);
  118. return value;
  119. }
  120. uint32_t GPBCodedInputStreamReadUInt32(GPBCodedInputStreamState *state) {
  121. uint32_t value = ReadRawVarint32(state);
  122. return value;
  123. }
  124. int64_t GPBCodedInputStreamReadInt64(GPBCodedInputStreamState *state) {
  125. int64_t value = ReadRawVarint64(state);
  126. return value;
  127. }
  128. int32_t GPBCodedInputStreamReadInt32(GPBCodedInputStreamState *state) {
  129. int32_t value = ReadRawVarint32(state);
  130. return value;
  131. }
  132. uint64_t GPBCodedInputStreamReadFixed64(GPBCodedInputStreamState *state) {
  133. uint64_t value = ReadRawLittleEndian64(state);
  134. return value;
  135. }
  136. uint32_t GPBCodedInputStreamReadFixed32(GPBCodedInputStreamState *state) {
  137. uint32_t value = ReadRawLittleEndian32(state);
  138. return value;
  139. }
  140. int32_t GPBCodedInputStreamReadEnum(GPBCodedInputStreamState *state) {
  141. int32_t value = ReadRawVarint32(state);
  142. return value;
  143. }
  144. int32_t GPBCodedInputStreamReadSFixed32(GPBCodedInputStreamState *state) {
  145. int32_t value = ReadRawLittleEndian32(state);
  146. return value;
  147. }
  148. int64_t GPBCodedInputStreamReadSFixed64(GPBCodedInputStreamState *state) {
  149. int64_t value = ReadRawLittleEndian64(state);
  150. return value;
  151. }
  152. int32_t GPBCodedInputStreamReadSInt32(GPBCodedInputStreamState *state) {
  153. int32_t value = GPBDecodeZigZag32(ReadRawVarint32(state));
  154. return value;
  155. }
  156. int64_t GPBCodedInputStreamReadSInt64(GPBCodedInputStreamState *state) {
  157. int64_t value = GPBDecodeZigZag64(ReadRawVarint64(state));
  158. return value;
  159. }
  160. BOOL GPBCodedInputStreamReadBool(GPBCodedInputStreamState *state) {
  161. return ReadRawVarint64(state) != 0;
  162. }
  163. int32_t GPBCodedInputStreamReadTag(GPBCodedInputStreamState *state) {
  164. if (GPBCodedInputStreamIsAtEnd(state)) {
  165. state->lastTag = 0;
  166. return 0;
  167. }
  168. state->lastTag = ReadRawVarint32(state);
  169. // Tags have to include a valid wireformat.
  170. if (!GPBWireFormatIsValidTag(state->lastTag)) {
  171. RaiseException(GPBCodedInputStreamErrorInvalidTag, @"Invalid wireformat in tag.");
  172. }
  173. // Zero is not a valid field number.
  174. if (GPBWireFormatGetTagFieldNumber(state->lastTag) == 0) {
  175. RaiseException(GPBCodedInputStreamErrorInvalidTag,
  176. @"A zero field number on the wire is invalid.");
  177. }
  178. return state->lastTag;
  179. }
  180. NSString *GPBCodedInputStreamReadRetainedString(GPBCodedInputStreamState *state) {
  181. uint64_t size = GPBCodedInputStreamReadUInt64(state);
  182. CheckFieldSize(size);
  183. NSUInteger ns_size = (NSUInteger)size;
  184. NSString *result;
  185. if (size == 0) {
  186. result = @"";
  187. } else {
  188. size_t size2 = (size_t)size; // Cast safe on 32bit because of CheckFieldSize() above.
  189. CheckSize(state, size2);
  190. result = [[NSString alloc] initWithBytes:&state->bytes[state->bufferPos]
  191. length:ns_size
  192. encoding:NSUTF8StringEncoding];
  193. state->bufferPos += size;
  194. if (!result) {
  195. #ifdef DEBUG
  196. // https://developers.google.com/protocol-buffers/docs/proto#scalar
  197. NSLog(@"UTF-8 failure, is some field type 'string' when it should be "
  198. @"'bytes'?");
  199. #endif
  200. RaiseException(GPBCodedInputStreamErrorInvalidUTF8, nil);
  201. }
  202. }
  203. return result;
  204. }
  205. NSData *GPBCodedInputStreamReadRetainedBytes(GPBCodedInputStreamState *state) {
  206. uint64_t size = GPBCodedInputStreamReadUInt64(state);
  207. CheckFieldSize(size);
  208. size_t size2 = (size_t)size; // Cast safe on 32bit because of CheckFieldSize() above.
  209. CheckSize(state, size2);
  210. NSUInteger ns_size = (NSUInteger)size;
  211. NSData *result = [[NSData alloc] initWithBytes:state->bytes + state->bufferPos length:ns_size];
  212. state->bufferPos += size;
  213. return result;
  214. }
  215. NSData *GPBCodedInputStreamReadRetainedBytesNoCopy(GPBCodedInputStreamState *state) {
  216. uint64_t size = GPBCodedInputStreamReadUInt64(state);
  217. CheckFieldSize(size);
  218. size_t size2 = (size_t)size; // Cast safe on 32bit because of CheckFieldSize() above.
  219. CheckSize(state, size2);
  220. NSUInteger ns_size = (NSUInteger)size;
  221. // Cast is safe because freeWhenDone is NO.
  222. NSData *result = [[NSData alloc] initWithBytesNoCopy:(void *)(state->bytes + state->bufferPos)
  223. length:ns_size
  224. freeWhenDone:NO];
  225. state->bufferPos += size;
  226. return result;
  227. }
  228. size_t GPBCodedInputStreamPushLimit(GPBCodedInputStreamState *state, size_t byteLimit) {
  229. byteLimit += state->bufferPos;
  230. size_t oldLimit = state->currentLimit;
  231. if (byteLimit > oldLimit) {
  232. RaiseException(GPBCodedInputStreamErrorInvalidSubsectionLimit, nil);
  233. }
  234. state->currentLimit = byteLimit;
  235. return oldLimit;
  236. }
  237. void GPBCodedInputStreamPopLimit(GPBCodedInputStreamState *state, size_t oldLimit) {
  238. state->currentLimit = oldLimit;
  239. }
  240. size_t GPBCodedInputStreamBytesUntilLimit(GPBCodedInputStreamState *state) {
  241. return state->currentLimit - state->bufferPos;
  242. }
  243. BOOL GPBCodedInputStreamIsAtEnd(GPBCodedInputStreamState *state) {
  244. return (state->bufferPos == state->bufferSize) || (state->bufferPos == state->currentLimit);
  245. }
  246. void GPBCodedInputStreamCheckLastTagWas(GPBCodedInputStreamState *state, int32_t value) {
  247. if (state->lastTag != value) {
  248. RaiseException(GPBCodedInputStreamErrorInvalidTag, @"Unexpected tag read");
  249. }
  250. }
  251. @implementation GPBCodedInputStream
  252. + (instancetype)streamWithData:(NSData *)data {
  253. return [[[self alloc] initWithData:data] autorelease];
  254. }
  255. - (instancetype)initWithData:(NSData *)data {
  256. if ((self = [super init])) {
  257. #ifdef DEBUG
  258. NSCAssert([self class] == [GPBCodedInputStream class],
  259. @"Subclassing of GPBCodedInputStream is not allowed.");
  260. #endif
  261. buffer_ = [data retain];
  262. state_.bytes = (const uint8_t *)[data bytes];
  263. state_.bufferSize = [data length];
  264. state_.currentLimit = state_.bufferSize;
  265. }
  266. return self;
  267. }
  268. - (void)dealloc {
  269. [buffer_ release];
  270. [super dealloc];
  271. }
  272. // Direct access is use for speed, to avoid even internally declaring things
  273. // read/write, etc. The warning is enabled in the project to ensure code calling
  274. // protos can turn on -Wdirect-ivar-access without issues.
  275. #pragma clang diagnostic push
  276. #pragma clang diagnostic ignored "-Wdirect-ivar-access"
  277. - (int32_t)readTag {
  278. return GPBCodedInputStreamReadTag(&state_);
  279. }
  280. - (void)checkLastTagWas:(int32_t)value {
  281. GPBCodedInputStreamCheckLastTagWas(&state_, value);
  282. }
  283. - (BOOL)skipField:(int32_t)tag {
  284. NSAssert(GPBWireFormatIsValidTag(tag), @"Invalid tag");
  285. switch (GPBWireFormatGetTagWireType(tag)) {
  286. case GPBWireFormatVarint:
  287. GPBCodedInputStreamReadInt32(&state_);
  288. return YES;
  289. case GPBWireFormatFixed64:
  290. SkipRawData(&state_, sizeof(int64_t));
  291. return YES;
  292. case GPBWireFormatLengthDelimited: {
  293. uint64_t size = GPBCodedInputStreamReadUInt64(&state_);
  294. CheckFieldSize(size);
  295. size_t size2 = (size_t)size; // Cast safe on 32bit because of CheckFieldSize() above.
  296. SkipRawData(&state_, size2);
  297. return YES;
  298. }
  299. case GPBWireFormatStartGroup:
  300. [self skipMessage];
  301. GPBCodedInputStreamCheckLastTagWas(
  302. &state_,
  303. GPBWireFormatMakeTag(GPBWireFormatGetTagFieldNumber(tag), GPBWireFormatEndGroup));
  304. return YES;
  305. case GPBWireFormatEndGroup:
  306. return NO;
  307. case GPBWireFormatFixed32:
  308. SkipRawData(&state_, sizeof(int32_t));
  309. return YES;
  310. }
  311. }
  312. - (void)skipMessage {
  313. while (YES) {
  314. int32_t tag = GPBCodedInputStreamReadTag(&state_);
  315. if (tag == 0 || ![self skipField:tag]) {
  316. return;
  317. }
  318. }
  319. }
  320. - (BOOL)isAtEnd {
  321. return GPBCodedInputStreamIsAtEnd(&state_);
  322. }
  323. - (size_t)position {
  324. return state_.bufferPos;
  325. }
  326. - (size_t)pushLimit:(size_t)byteLimit {
  327. return GPBCodedInputStreamPushLimit(&state_, byteLimit);
  328. }
  329. - (void)popLimit:(size_t)oldLimit {
  330. GPBCodedInputStreamPopLimit(&state_, oldLimit);
  331. }
  332. - (double)readDouble {
  333. return GPBCodedInputStreamReadDouble(&state_);
  334. }
  335. - (float)readFloat {
  336. return GPBCodedInputStreamReadFloat(&state_);
  337. }
  338. - (uint64_t)readUInt64 {
  339. return GPBCodedInputStreamReadUInt64(&state_);
  340. }
  341. - (int64_t)readInt64 {
  342. return GPBCodedInputStreamReadInt64(&state_);
  343. }
  344. - (int32_t)readInt32 {
  345. return GPBCodedInputStreamReadInt32(&state_);
  346. }
  347. - (uint64_t)readFixed64 {
  348. return GPBCodedInputStreamReadFixed64(&state_);
  349. }
  350. - (uint32_t)readFixed32 {
  351. return GPBCodedInputStreamReadFixed32(&state_);
  352. }
  353. - (BOOL)readBool {
  354. return GPBCodedInputStreamReadBool(&state_);
  355. }
  356. - (NSString *)readString {
  357. return [GPBCodedInputStreamReadRetainedString(&state_) autorelease];
  358. }
  359. - (void)readGroup:(int32_t)fieldNumber
  360. message:(GPBMessage *)message
  361. extensionRegistry:(id<GPBExtensionRegistry>)extensionRegistry {
  362. CheckRecursionLimit(&state_);
  363. ++state_.recursionDepth;
  364. [message mergeFromCodedInputStream:self extensionRegistry:extensionRegistry];
  365. GPBCodedInputStreamCheckLastTagWas(&state_,
  366. GPBWireFormatMakeTag(fieldNumber, GPBWireFormatEndGroup));
  367. --state_.recursionDepth;
  368. }
  369. - (void)readUnknownGroup:(int32_t)fieldNumber message:(GPBUnknownFieldSet *)message {
  370. CheckRecursionLimit(&state_);
  371. ++state_.recursionDepth;
  372. [message mergeFromCodedInputStream:self];
  373. GPBCodedInputStreamCheckLastTagWas(&state_,
  374. GPBWireFormatMakeTag(fieldNumber, GPBWireFormatEndGroup));
  375. --state_.recursionDepth;
  376. }
  377. - (void)readMessage:(GPBMessage *)message
  378. extensionRegistry:(id<GPBExtensionRegistry>)extensionRegistry {
  379. CheckRecursionLimit(&state_);
  380. uint64_t length = GPBCodedInputStreamReadUInt64(&state_);
  381. CheckFieldSize(length);
  382. size_t length2 = (size_t)length; // Cast safe on 32bit because of CheckFieldSize() above.
  383. size_t oldLimit = GPBCodedInputStreamPushLimit(&state_, length2);
  384. ++state_.recursionDepth;
  385. [message mergeFromCodedInputStream:self extensionRegistry:extensionRegistry];
  386. GPBCodedInputStreamCheckLastTagWas(&state_, 0);
  387. --state_.recursionDepth;
  388. GPBCodedInputStreamPopLimit(&state_, oldLimit);
  389. }
  390. - (void)readMapEntry:(id)mapDictionary
  391. extensionRegistry:(id<GPBExtensionRegistry>)extensionRegistry
  392. field:(GPBFieldDescriptor *)field
  393. parentMessage:(GPBMessage *)parentMessage {
  394. CheckRecursionLimit(&state_);
  395. uint64_t length = GPBCodedInputStreamReadUInt64(&state_);
  396. CheckFieldSize(length);
  397. size_t length2 = (size_t)length; // Cast safe on 32bit because of CheckFieldSize() above.
  398. size_t oldLimit = GPBCodedInputStreamPushLimit(&state_, length2);
  399. ++state_.recursionDepth;
  400. GPBDictionaryReadEntry(mapDictionary, self, extensionRegistry, field, parentMessage);
  401. GPBCodedInputStreamCheckLastTagWas(&state_, 0);
  402. --state_.recursionDepth;
  403. GPBCodedInputStreamPopLimit(&state_, oldLimit);
  404. }
  405. - (NSData *)readBytes {
  406. return [GPBCodedInputStreamReadRetainedBytes(&state_) autorelease];
  407. }
  408. - (uint32_t)readUInt32 {
  409. return GPBCodedInputStreamReadUInt32(&state_);
  410. }
  411. - (int32_t)readEnum {
  412. return GPBCodedInputStreamReadEnum(&state_);
  413. }
  414. - (int32_t)readSFixed32 {
  415. return GPBCodedInputStreamReadSFixed32(&state_);
  416. }
  417. - (int64_t)readSFixed64 {
  418. return GPBCodedInputStreamReadSFixed64(&state_);
  419. }
  420. - (int32_t)readSInt32 {
  421. return GPBCodedInputStreamReadSInt32(&state_);
  422. }
  423. - (int64_t)readSInt64 {
  424. return GPBCodedInputStreamReadSInt64(&state_);
  425. }
  426. #pragma clang diagnostic pop
  427. @end