From 0d915e6fc518bc9e85a18bb44f2aacc1a32c215b Mon Sep 17 00:00:00 2001 From: Julien Date: Thu, 23 Jul 2026 12:46:09 +0200 Subject: [PATCH] Update protobuf to 3.7.2 (#684) * Update protobuf to 3.7.2 Signed-off-by: Julien Arnaud * Harden protobuf recursion regression Signed-off-by: Julien Arnaud --------- Signed-off-by: Julien Arnaud Co-authored-by: Julien Arnaud --- Cargo.lock | 16 ++++++++-------- tests/protobuf_recursion.rs | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 8 deletions(-) create mode 100644 tests/protobuf_recursion.rs diff --git a/Cargo.lock b/Cargo.lock index c0195a6..e9a5b7d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3027,9 +3027,9 @@ dependencies = [ [[package]] name = "protobuf" -version = "3.7.1" +version = "3.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a3a7c64d9bf75b1b8d981124c14c179074e8caa7dfe7b6a12e6222ddcd0c8f72" +checksum = "d65a1d4ddae7d8b5de68153b48f6aa3bba8cb002b243dbdbc55a5afbc98f99f4" dependencies = [ "bytes", "once_cell", @@ -3039,9 +3039,9 @@ dependencies = [ [[package]] name = "protobuf-codegen" -version = "3.7.1" +version = "3.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e26b833f144769a30e04b1db0146b2aaa53fd2fd83acf10a6b5f996606c18144" +checksum = "5d3976825c0014bbd2f3b34f0001876604fe87e0c86cd8fa54251530f1544ace" dependencies = [ "anyhow", "once_cell", @@ -3054,9 +3054,9 @@ dependencies = [ [[package]] name = "protobuf-parse" -version = "3.7.1" +version = "3.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "322330e133eab455718444b4e033ebfac7c6528972c784fcde28d2cc783c6257" +checksum = "b4aeaa1f2460f1d348eeaeed86aea999ce98c1bded6f089ff8514c9d9dbdc973" dependencies = [ "anyhow", "indexmap 2.7.0", @@ -3070,9 +3070,9 @@ dependencies = [ [[package]] name = "protobuf-support" -version = "3.7.1" +version = "3.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b088fd20b938a875ea00843b6faf48579462630015c3788d397ad6a786663252" +checksum = "3e36c2f31e0a47f9280fb347ef5e461ffcd2c52dd520d8e216b52f93b0b0d7d6" dependencies = [ "thiserror 1.0.31", ] diff --git a/tests/protobuf_recursion.rs b/tests/protobuf_recursion.rs new file mode 100644 index 0000000..e45be85 --- /dev/null +++ b/tests/protobuf_recursion.rs @@ -0,0 +1,34 @@ +use hbb_common::{protobuf::Message, rendezvous_proto::RendezvousMessage}; +use std::process::Command; + +const CHILD_ENV: &str = "RUSTDESK_PROTOBUF_RECURSION_CHILD"; +const CHILD_COMPLETION_SENTINEL: &str = "protobuf_recursion_child_completed"; +const TEST_NAME: &str = "deeply_nested_unknown_groups_are_rejected_without_aborting"; + +#[test] +fn deeply_nested_unknown_groups_are_rejected_without_aborting() { + if std::env::var_os(CHILD_ENV).is_some() { + const DEPTH: usize = 300_000; + let mut input = vec![0x0b; DEPTH]; + input.extend(std::iter::repeat(0x0c).take(DEPTH)); + + assert!(RendezvousMessage::parse_from_bytes(&input).is_err()); + println!("{CHILD_COMPLETION_SENTINEL}"); + return; + } + + let output = Command::new(std::env::current_exe().expect("locate the test binary")) + .args(["--exact", TEST_NAME, "--nocapture"]) + .env(CHILD_ENV, "1") + .output() + .expect("run the recursive-input check in an isolated process"); + + let stdout = String::from_utf8_lossy(&output.stdout); + assert!( + output.status.success() && stdout.lines().any(|line| line == CHILD_COMPLETION_SENTINEL), + "child parser check did not complete successfully (status: {}):\nstdout:\n{}\nstderr:\n{}", + output.status, + stdout, + String::from_utf8_lossy(&output.stderr) + ); +}