Security context

Highlights

Information Disclosure: 1 prior fix. Scrutinize any change in this area.

src/google/protobuf/repeated_field.h: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Integer Overflow: Integer overflow in capacity calculations during upb arena memory allocation can cause underallocated memory zones, resulting in heap-based out-of-bounds writes when copying payload data. This requires robust pre-allocation overflow checks on untrusted serialization streams.

Information Disclosure: Lack of self-reference validation when merging repeated fields (specifically during transitions from the Small Object Optimization to heap allocation) can cause uninitialized heap bytes or raw internal pointers to be exposed.

Stack Buffer Overflow: Unsafe handling of string conversions and localized numeric formats in localized parsing utilities can lead to stack buffer overflows via strcpy/memcpy during numeric parsing.