parse_context.h 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869
  1. // Protocol Buffers - Google's data interchange format
  2. // Copyright 2008 Google Inc. All rights reserved.
  3. // https://developers.google.com/protocol-buffers/
  4. //
  5. // Redistribution and use in source and binary forms, with or without
  6. // modification, are permitted provided that the following conditions are
  7. // met:
  8. //
  9. // * Redistributions of source code must retain the above copyright
  10. // notice, this list of conditions and the following disclaimer.
  11. // * Redistributions in binary form must reproduce the above
  12. // copyright notice, this list of conditions and the following disclaimer
  13. // in the documentation and/or other materials provided with the
  14. // distribution.
  15. // * Neither the name of Google Inc. nor the names of its
  16. // contributors may be used to endorse or promote products derived from
  17. // this software without specific prior written permission.
  18. //
  19. // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20. // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21. // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  22. // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  23. // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  24. // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  25. // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26. // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27. // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28. // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  29. // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30. #ifndef GOOGLE_PROTOBUF_PARSE_CONTEXT_H__
  31. #define GOOGLE_PROTOBUF_PARSE_CONTEXT_H__
  32. #include <cstdint>
  33. #include <cstring>
  34. #include <string>
  35. #include <google/protobuf/io/coded_stream.h>
  36. #include <google/protobuf/io/zero_copy_stream.h>
  37. #include <google/protobuf/arena.h>
  38. #include <google/protobuf/arenastring.h>
  39. #include <google/protobuf/implicit_weak_message.h>
  40. #include <google/protobuf/metadata_lite.h>
  41. #include <google/protobuf/port.h>
  42. #include <google/protobuf/repeated_field.h>
  43. #include <google/protobuf/wire_format_lite.h>
  44. #include <google/protobuf/stubs/strutil.h>
  45. #include <google/protobuf/port_def.inc>
  46. namespace google {
  47. namespace protobuf {
  48. class UnknownFieldSet;
  49. class DescriptorPool;
  50. class MessageFactory;
  51. namespace internal {
  52. // Template code below needs to know about the existence of these functions.
  53. PROTOBUF_EXPORT void WriteVarint(uint32 num, uint64 val, std::string* s);
  54. PROTOBUF_EXPORT void WriteLengthDelimited(uint32 num, StringPiece val,
  55. std::string* s);
  56. // Inline because it is just forwarding to s->WriteVarint
  57. inline void WriteVarint(uint32 num, uint64 val, UnknownFieldSet* s);
  58. inline void WriteLengthDelimited(uint32 num, StringPiece val,
  59. UnknownFieldSet* s);
  60. // The basic abstraction the parser is designed for is a slight modification
  61. // of the ZeroCopyInputStream (ZCIS) abstraction. A ZCIS presents a serialized
  62. // stream as a series of buffers that concatenate to the full stream.
  63. // Pictorially a ZCIS presents a stream in chunks like so
  64. // [---------------------------------------------------------------]
  65. // [---------------------] chunk 1
  66. // [----------------------------] chunk 2
  67. // chunk 3 [--------------]
  68. //
  69. // Where the '-' represent the bytes which are vertically lined up with the
  70. // bytes of the stream. The proto parser requires its input to be presented
  71. // similarly with the extra
  72. // property that each chunk has kSlopBytes past its end that overlaps with the
  73. // first kSlopBytes of the next chunk, or if there is no next chunk at least its
  74. // still valid to read those bytes. Again, pictorially, we now have
  75. //
  76. // [---------------------------------------------------------------]
  77. // [-------------------....] chunk 1
  78. // [------------------------....] chunk 2
  79. // chunk 3 [------------------..**]
  80. // chunk 4 [--****]
  81. // Here '-' mean the bytes of the stream or chunk and '.' means bytes past the
  82. // chunk that match up with the start of the next chunk. Above each chunk has
  83. // 4 '.' after the chunk. In the case these 'overflow' bytes represents bytes
  84. // past the stream, indicated by '*' above, their values are unspecified. It is
  85. // still legal to read them (ie. should not segfault). Reading past the
  86. // end should be detected by the user and indicated as an error.
  87. //
  88. // The reason for this, admittedly, unconventional invariant is to ruthlessly
  89. // optimize the protobuf parser. Having an overlap helps in two important ways.
  90. // Firstly it alleviates having to performing bounds checks if a piece of code
  91. // is guaranteed to not read more than kSlopBytes. Secondly, and more
  92. // importantly, the protobuf wireformat is such that reading a key/value pair is
  93. // always less than 16 bytes. This removes the need to change to next buffer in
  94. // the middle of reading primitive values. Hence there is no need to store and
  95. // load the current position.
  96. class PROTOBUF_EXPORT EpsCopyInputStream {
  97. public:
  98. enum { kSlopBytes = 16, kMaxCordBytesToCopy = 512 };
  99. explicit EpsCopyInputStream(bool enable_aliasing)
  100. : aliasing_(enable_aliasing ? kOnPatch : kNoAliasing) {}
  101. void BackUp(const char* ptr) {
  102. GOOGLE_DCHECK(ptr <= buffer_end_ + kSlopBytes);
  103. int count;
  104. if (next_chunk_ == buffer_) {
  105. count = static_cast<int>(buffer_end_ + kSlopBytes - ptr);
  106. } else {
  107. count = size_ + static_cast<int>(buffer_end_ - ptr);
  108. }
  109. if (count > 0) StreamBackUp(count);
  110. }
  111. // If return value is negative it's an error
  112. PROTOBUF_MUST_USE_RESULT int PushLimit(const char* ptr, int limit) {
  113. GOOGLE_DCHECK(limit >= 0 && limit <= INT_MAX - kSlopBytes);
  114. // This add is safe due to the invariant above, because
  115. // ptr - buffer_end_ <= kSlopBytes.
  116. limit += static_cast<int>(ptr - buffer_end_);
  117. limit_end_ = buffer_end_ + (std::min)(0, limit);
  118. auto old_limit = limit_;
  119. limit_ = limit;
  120. return old_limit - limit;
  121. }
  122. PROTOBUF_MUST_USE_RESULT bool PopLimit(int delta) {
  123. if (PROTOBUF_PREDICT_FALSE(!EndedAtLimit())) return false;
  124. limit_ = limit_ + delta;
  125. // TODO(gerbens) We could remove this line and hoist the code to
  126. // DoneFallback. Study the perf/bin-size effects.
  127. limit_end_ = buffer_end_ + (std::min)(0, limit_);
  128. return true;
  129. }
  130. PROTOBUF_MUST_USE_RESULT const char* Skip(const char* ptr, int size) {
  131. if (size <= buffer_end_ + kSlopBytes - ptr) {
  132. return ptr + size;
  133. }
  134. return SkipFallback(ptr, size);
  135. }
  136. PROTOBUF_MUST_USE_RESULT const char* ReadString(const char* ptr, int size,
  137. std::string* s) {
  138. if (size <= buffer_end_ + kSlopBytes - ptr) {
  139. s->assign(ptr, size);
  140. return ptr + size;
  141. }
  142. return ReadStringFallback(ptr, size, s);
  143. }
  144. PROTOBUF_MUST_USE_RESULT const char* AppendString(const char* ptr, int size,
  145. std::string* s) {
  146. if (size <= buffer_end_ + kSlopBytes - ptr) {
  147. s->append(ptr, size);
  148. return ptr + size;
  149. }
  150. return AppendStringFallback(ptr, size, s);
  151. }
  152. template <typename Tag, typename T>
  153. PROTOBUF_MUST_USE_RESULT const char* ReadRepeatedFixed(const char* ptr,
  154. Tag expected_tag,
  155. RepeatedField<T>* out);
  156. template <typename T>
  157. PROTOBUF_MUST_USE_RESULT const char* ReadPackedFixed(const char* ptr,
  158. int size,
  159. RepeatedField<T>* out);
  160. template <typename Add>
  161. PROTOBUF_MUST_USE_RESULT const char* ReadPackedVarint(const char* ptr,
  162. Add add);
  163. uint32 LastTag() const { return last_tag_minus_1_ + 1; }
  164. bool ConsumeEndGroup(uint32 start_tag) {
  165. bool res = last_tag_minus_1_ == start_tag;
  166. last_tag_minus_1_ = 0;
  167. return res;
  168. }
  169. bool EndedAtLimit() const { return last_tag_minus_1_ == 0; }
  170. bool EndedAtEndOfStream() const { return last_tag_minus_1_ == 1; }
  171. void SetLastTag(uint32 tag) { last_tag_minus_1_ = tag - 1; }
  172. void SetEndOfStream() { last_tag_minus_1_ = 1; }
  173. bool IsExceedingLimit(const char* ptr) {
  174. return ptr > limit_end_ &&
  175. (next_chunk_ == nullptr || ptr - buffer_end_ > limit_);
  176. }
  177. int BytesUntilLimit(const char* ptr) const {
  178. return limit_ + static_cast<int>(buffer_end_ - ptr);
  179. }
  180. // Returns true if more data is available, if false is returned one has to
  181. // call Done for further checks.
  182. bool DataAvailable(const char* ptr) { return ptr < limit_end_; }
  183. protected:
  184. // Returns true is limit (either an explicit limit or end of stream) is
  185. // reached. It aligns *ptr across buffer seams.
  186. // If limit is exceeded it returns true and ptr is set to null.
  187. bool DoneWithCheck(const char** ptr, int d) {
  188. GOOGLE_DCHECK(*ptr);
  189. if (PROTOBUF_PREDICT_TRUE(*ptr < limit_end_)) return false;
  190. int overrun = static_cast<int>(*ptr - buffer_end_);
  191. GOOGLE_DCHECK_LE(overrun, kSlopBytes); // Guaranteed by parse loop.
  192. if (overrun ==
  193. limit_) { // No need to flip buffers if we ended on a limit.
  194. // If we actually overrun the buffer and next_chunk_ is null. It means
  195. // the stream ended and we passed the stream end.
  196. if (overrun > 0 && next_chunk_ == nullptr) *ptr = nullptr;
  197. return true;
  198. }
  199. auto res = DoneFallback(overrun, d);
  200. *ptr = res.first;
  201. return res.second;
  202. }
  203. const char* InitFrom(StringPiece flat) {
  204. overall_limit_ = 0;
  205. if (flat.size() > kSlopBytes) {
  206. limit_ = kSlopBytes;
  207. limit_end_ = buffer_end_ = flat.data() + flat.size() - kSlopBytes;
  208. next_chunk_ = buffer_;
  209. if (aliasing_ == kOnPatch) aliasing_ = kNoDelta;
  210. return flat.data();
  211. } else {
  212. std::memcpy(buffer_, flat.data(), flat.size());
  213. limit_ = 0;
  214. limit_end_ = buffer_end_ = buffer_ + flat.size();
  215. next_chunk_ = nullptr;
  216. if (aliasing_ == kOnPatch) {
  217. aliasing_ = reinterpret_cast<std::uintptr_t>(flat.data()) -
  218. reinterpret_cast<std::uintptr_t>(buffer_);
  219. }
  220. return buffer_;
  221. }
  222. }
  223. const char* InitFrom(io::ZeroCopyInputStream* zcis);
  224. const char* InitFrom(io::ZeroCopyInputStream* zcis, int limit) {
  225. if (limit == -1) return InitFrom(zcis);
  226. overall_limit_ = limit;
  227. auto res = InitFrom(zcis);
  228. limit_ = limit - static_cast<int>(buffer_end_ - res);
  229. limit_end_ = buffer_end_ + (std::min)(0, limit_);
  230. return res;
  231. }
  232. private:
  233. const char* limit_end_; // buffer_end_ + min(limit_, 0)
  234. const char* buffer_end_;
  235. const char* next_chunk_;
  236. int size_;
  237. int limit_; // relative to buffer_end_;
  238. io::ZeroCopyInputStream* zcis_ = nullptr;
  239. char buffer_[2 * kSlopBytes] = {};
  240. enum { kNoAliasing = 0, kOnPatch = 1, kNoDelta = 2 };
  241. std::uintptr_t aliasing_ = kNoAliasing;
  242. // This variable is used to communicate how the parse ended, in order to
  243. // completely verify the parsed data. A wire-format parse can end because of
  244. // one of the following conditions:
  245. // 1) A parse can end on a pushed limit.
  246. // 2) A parse can end on End Of Stream (EOS).
  247. // 3) A parse can end on 0 tag (only valid for toplevel message).
  248. // 4) A parse can end on an end-group tag.
  249. // This variable should always be set to 0, which indicates case 1. If the
  250. // parse terminated due to EOS (case 2), it's set to 1. In case the parse
  251. // ended due to a terminating tag (case 3 and 4) it's set to (tag - 1).
  252. // This var doesn't really belong in EpsCopyInputStream and should be part of
  253. // the ParseContext, but case 2 is most easily and optimally implemented in
  254. // DoneFallback.
  255. uint32 last_tag_minus_1_ = 0;
  256. int overall_limit_ = INT_MAX; // Overall limit independent of pushed limits.
  257. // Pretty random large number that seems like a safe allocation on most
  258. // systems. TODO(gerbens) do we need to set this as build flag?
  259. enum { kSafeStringSize = 50000000 };
  260. // Advances to next buffer chunk returns a pointer to the same logical place
  261. // in the stream as set by overrun. Overrun indicates the position in the slop
  262. // region the parse was left (0 <= overrun <= kSlopBytes). Returns true if at
  263. // limit, at which point the returned pointer maybe null if there was an
  264. // error. The invariant of this function is that it's guaranteed that
  265. // kSlopBytes bytes can be accessed from the returned ptr. This function might
  266. // advance more buffers than one in the underlying ZeroCopyInputStream.
  267. std::pair<const char*, bool> DoneFallback(int overrun, int depth);
  268. // Advances to the next buffer, at most one call to Next() on the underlying
  269. // ZeroCopyInputStream is made. This function DOES NOT match the returned
  270. // pointer to where in the slop region the parse ends, hence no overrun
  271. // parameter. This is useful for string operations where you always copy
  272. // to the end of the buffer (including the slop region).
  273. const char* Next();
  274. // overrun is the location in the slop region the stream currently is
  275. // (0 <= overrun <= kSlopBytes). To prevent flipping to the next buffer of
  276. // the ZeroCopyInputStream in the case the parse will end in the last
  277. // kSlopBytes of the current buffer. depth is the current depth of nested
  278. // groups (or negative if the use case does not need careful tracking).
  279. inline const char* NextBuffer(int overrun, int depth);
  280. const char* SkipFallback(const char* ptr, int size);
  281. const char* AppendStringFallback(const char* ptr, int size, std::string* str);
  282. const char* ReadStringFallback(const char* ptr, int size, std::string* str);
  283. bool StreamNext(const void** data) {
  284. bool res = zcis_->Next(data, &size_);
  285. if (res) overall_limit_ -= size_;
  286. return res;
  287. }
  288. void StreamBackUp(int count) {
  289. zcis_->BackUp(count);
  290. overall_limit_ += count;
  291. }
  292. template <typename A>
  293. const char* AppendSize(const char* ptr, int size, const A& append) {
  294. int chunk_size = buffer_end_ + kSlopBytes - ptr;
  295. do {
  296. GOOGLE_DCHECK(size > chunk_size);
  297. if (next_chunk_ == nullptr) return nullptr;
  298. append(ptr, chunk_size);
  299. ptr += chunk_size;
  300. size -= chunk_size;
  301. // TODO(gerbens) Next calls NextBuffer which generates buffers with
  302. // overlap and thus incurs cost of copying the slop regions. This is not
  303. // necessary for reading strings. We should just call Next buffers.
  304. if (limit_ <= kSlopBytes) return nullptr;
  305. ptr = Next();
  306. if (ptr == nullptr) return nullptr; // passed the limit
  307. ptr += kSlopBytes;
  308. chunk_size = buffer_end_ + kSlopBytes - ptr;
  309. } while (size > chunk_size);
  310. append(ptr, size);
  311. return ptr + size;
  312. }
  313. // AppendUntilEnd appends data until a limit (either a PushLimit or end of
  314. // stream. Normal payloads are from length delimited fields which have an
  315. // explicit size. Reading until limit only comes when the string takes
  316. // the place of a protobuf, ie RawMessage/StringRawMessage, lazy fields and
  317. // implicit weak messages. We keep these methods private and friend them.
  318. template <typename A>
  319. const char* AppendUntilEnd(const char* ptr, const A& append) {
  320. if (ptr - buffer_end_ > limit_) return nullptr;
  321. while (limit_ > kSlopBytes) {
  322. size_t chunk_size = buffer_end_ + kSlopBytes - ptr;
  323. GOOGLE_DCHECK_GE(chunk_size, static_cast<size_t>(0));
  324. append(ptr, chunk_size);
  325. ptr = Next();
  326. if (ptr == nullptr) return limit_end_;
  327. ptr += kSlopBytes;
  328. }
  329. auto end = buffer_end_ + limit_;
  330. GOOGLE_DCHECK(end >= ptr);
  331. append(ptr, end - ptr);
  332. return end;
  333. }
  334. PROTOBUF_MUST_USE_RESULT const char* AppendString(const char* ptr,
  335. std::string* str) {
  336. return AppendUntilEnd(
  337. ptr, [str](const char* p, ptrdiff_t s) { str->append(p, s); });
  338. }
  339. friend class ImplicitWeakMessage;
  340. };
  341. // ParseContext holds all data that is global to the entire parse. Most
  342. // importantly it contains the input stream, but also recursion depth and also
  343. // stores the end group tag, in case a parser ended on a endgroup, to verify
  344. // matching start/end group tags.
  345. class PROTOBUF_EXPORT ParseContext : public EpsCopyInputStream {
  346. public:
  347. struct Data {
  348. const DescriptorPool* pool = nullptr;
  349. MessageFactory* factory = nullptr;
  350. };
  351. template <typename... T>
  352. ParseContext(int depth, bool aliasing, const char** start, T&&... args)
  353. : EpsCopyInputStream(aliasing), depth_(depth) {
  354. *start = InitFrom(std::forward<T>(args)...);
  355. }
  356. void TrackCorrectEnding() { group_depth_ = 0; }
  357. bool Done(const char** ptr) { return DoneWithCheck(ptr, group_depth_); }
  358. int depth() const { return depth_; }
  359. Data& data() { return data_; }
  360. const Data& data() const { return data_; }
  361. template <typename T>
  362. PROTOBUF_MUST_USE_RESULT const char* ParseMessage(T* msg, const char* ptr);
  363. // We outline when the type is generic and we go through a virtual
  364. const char* ParseMessage(MessageLite* msg, const char* ptr);
  365. const char* ParseMessage(Message* msg, const char* ptr);
  366. template <typename T>
  367. PROTOBUF_MUST_USE_RESULT PROTOBUF_NDEBUG_INLINE const char* ParseGroup(
  368. T* msg, const char* ptr, uint32 tag) {
  369. if (--depth_ < 0) return nullptr;
  370. group_depth_++;
  371. ptr = msg->_InternalParse(ptr, this);
  372. group_depth_--;
  373. depth_++;
  374. if (PROTOBUF_PREDICT_FALSE(!ConsumeEndGroup(tag))) return nullptr;
  375. return ptr;
  376. }
  377. private:
  378. // The context keeps an internal stack to keep track of the recursive
  379. // part of the parse state.
  380. // Current depth of the active parser, depth counts down.
  381. // This is used to limit recursion depth (to prevent overflow on malicious
  382. // data), but is also used to index in stack_ to store the current state.
  383. int depth_;
  384. // Unfortunately necessary for the fringe case of ending on 0 or end-group tag
  385. // in the last kSlopBytes of a ZeroCopyInputStream chunk.
  386. int group_depth_ = INT_MIN;
  387. Data data_;
  388. };
  389. template <uint32 tag>
  390. bool ExpectTag(const char* ptr) {
  391. if (tag < 128) {
  392. return *ptr == static_cast<char>(tag);
  393. } else {
  394. static_assert(tag < 128 * 128, "We only expect tags for 1 or 2 bytes");
  395. char buf[2] = {static_cast<char>(tag | 0x80), static_cast<char>(tag >> 7)};
  396. return std::memcmp(ptr, buf, 2) == 0;
  397. }
  398. }
  399. template <int>
  400. struct EndianHelper;
  401. template <>
  402. struct EndianHelper<1> {
  403. static uint8 Load(const void* p) { return *static_cast<const uint8*>(p); }
  404. };
  405. template <>
  406. struct EndianHelper<2> {
  407. static uint16 Load(const void* p) {
  408. uint16 tmp;
  409. std::memcpy(&tmp, p, 2);
  410. #ifndef PROTOBUF_LITTLE_ENDIAN
  411. tmp = bswap_16(tmp);
  412. #endif
  413. return tmp;
  414. }
  415. };
  416. template <>
  417. struct EndianHelper<4> {
  418. static uint32 Load(const void* p) {
  419. uint32 tmp;
  420. std::memcpy(&tmp, p, 4);
  421. #ifndef PROTOBUF_LITTLE_ENDIAN
  422. tmp = bswap_32(tmp);
  423. #endif
  424. return tmp;
  425. }
  426. };
  427. template <>
  428. struct EndianHelper<8> {
  429. static uint64 Load(const void* p) {
  430. uint64 tmp;
  431. std::memcpy(&tmp, p, 8);
  432. #ifndef PROTOBUF_LITTLE_ENDIAN
  433. tmp = bswap_64(tmp);
  434. #endif
  435. return tmp;
  436. }
  437. };
  438. template <typename T>
  439. T UnalignedLoad(const char* p) {
  440. auto tmp = EndianHelper<sizeof(T)>::Load(p);
  441. T res;
  442. memcpy(&res, &tmp, sizeof(T));
  443. return res;
  444. }
  445. PROTOBUF_EXPORT
  446. std::pair<const char*, uint32> VarintParseSlow32(const char* p, uint32 res);
  447. PROTOBUF_EXPORT
  448. std::pair<const char*, uint64> VarintParseSlow64(const char* p, uint32 res);
  449. inline const char* VarintParseSlow(const char* p, uint32 res, uint32* out) {
  450. auto tmp = VarintParseSlow32(p, res);
  451. *out = tmp.second;
  452. return tmp.first;
  453. }
  454. inline const char* VarintParseSlow(const char* p, uint32 res, uint64* out) {
  455. auto tmp = VarintParseSlow64(p, res);
  456. *out = tmp.second;
  457. return tmp.first;
  458. }
  459. template <typename T>
  460. PROTOBUF_MUST_USE_RESULT const char* VarintParse(const char* p, T* out) {
  461. auto ptr = reinterpret_cast<const uint8*>(p);
  462. uint32 res = ptr[0];
  463. if (!(res & 0x80)) {
  464. *out = res;
  465. return p + 1;
  466. }
  467. uint32 byte = ptr[1];
  468. res += (byte - 1) << 7;
  469. if (!(byte & 0x80)) {
  470. *out = res;
  471. return p + 2;
  472. }
  473. return VarintParseSlow(p, res, out);
  474. }
  475. // Used for tags, could read up to 5 bytes which must be available.
  476. // Caller must ensure its safe to call.
  477. PROTOBUF_EXPORT
  478. std::pair<const char*, uint32> ReadTagFallback(const char* p, uint32 res);
  479. // Same as ParseVarint but only accept 5 bytes at most.
  480. inline const char* ReadTag(const char* p, uint32* out, uint32 /*max_tag*/ = 0) {
  481. uint32 res = static_cast<uint8>(p[0]);
  482. if (res < 128) {
  483. *out = res;
  484. return p + 1;
  485. }
  486. uint32 second = static_cast<uint8>(p[1]);
  487. res += (second - 1) << 7;
  488. if (second < 128) {
  489. *out = res;
  490. return p + 2;
  491. }
  492. auto tmp = ReadTagFallback(p, res);
  493. *out = tmp.second;
  494. return tmp.first;
  495. }
  496. // Decode 2 consecutive bytes of a varint and returns the value, shifted left
  497. // by 1. It simultaneous updates *ptr to *ptr + 1 or *ptr + 2 depending if the
  498. // first byte's continuation bit is set.
  499. // If bit 15 of return value is set (equivalent to the continuation bits of both
  500. // bytes being set) the varint continues, otherwise the parse is done. On x86
  501. // movsx eax, dil
  502. // add edi, eax
  503. // adc [rsi], 1
  504. // add eax, eax
  505. // and eax, edi
  506. inline uint32 DecodeTwoBytes(const char** ptr) {
  507. uint32 value = UnalignedLoad<uint16>(*ptr);
  508. // Sign extend the low byte continuation bit
  509. uint32_t x = static_cast<int8_t>(value);
  510. // This add is an amazing operation, it cancels the low byte continuation bit
  511. // from y transferring it to the carry. Simultaneously it also shifts the 7
  512. // LSB left by one tightly against high byte varint bits. Hence value now
  513. // contains the unpacked value shifted left by 1.
  514. value += x;
  515. // Use the carry to update the ptr appropriately.
  516. *ptr += value < x ? 2 : 1;
  517. return value & (x + x); // Mask out the high byte iff no continuation
  518. }
  519. // More efficient varint parsing for big varints
  520. inline const char* ParseBigVarint(const char* p, uint64* out) {
  521. auto pnew = p;
  522. auto tmp = DecodeTwoBytes(&pnew);
  523. uint64 res = tmp >> 1;
  524. if (PROTOBUF_PREDICT_TRUE(std::int16_t(tmp) >= 0)) {
  525. *out = res;
  526. return pnew;
  527. }
  528. for (std::uint32_t i = 1; i < 5; i++) {
  529. pnew = p + 2 * i;
  530. tmp = DecodeTwoBytes(&pnew);
  531. res += (static_cast<std::uint64_t>(tmp) - 2) << (14 * i - 1);
  532. if (PROTOBUF_PREDICT_TRUE(std::int16_t(tmp) >= 0)) {
  533. *out = res;
  534. return pnew;
  535. }
  536. }
  537. return nullptr;
  538. }
  539. PROTOBUF_EXPORT
  540. std::pair<const char*, int32> ReadSizeFallback(const char* p, uint32 first);
  541. // Used for tags, could read up to 5 bytes which must be available. Additionally
  542. // it makes sure the unsigned value fits a int32, otherwise returns nullptr.
  543. // Caller must ensure its safe to call.
  544. inline uint32 ReadSize(const char** pp) {
  545. auto p = *pp;
  546. uint32 res = static_cast<uint8>(p[0]);
  547. if (res < 128) {
  548. *pp = p + 1;
  549. return res;
  550. }
  551. auto x = ReadSizeFallback(p, res);
  552. *pp = x.first;
  553. return x.second;
  554. }
  555. // Some convenience functions to simplify the generated parse loop code.
  556. // Returning the value and updating the buffer pointer allows for nicer
  557. // function composition. We rely on the compiler to inline this.
  558. // Also in debug compiles having local scoped variables tend to generated
  559. // stack frames that scale as O(num fields).
  560. inline uint64 ReadVarint64(const char** p) {
  561. uint64 tmp;
  562. *p = VarintParse(*p, &tmp);
  563. return tmp;
  564. }
  565. inline uint32 ReadVarint32(const char** p) {
  566. uint32 tmp;
  567. *p = VarintParse(*p, &tmp);
  568. return tmp;
  569. }
  570. inline int64 ReadVarintZigZag64(const char** p) {
  571. uint64 tmp;
  572. *p = VarintParse(*p, &tmp);
  573. return WireFormatLite::ZigZagDecode64(tmp);
  574. }
  575. inline int32 ReadVarintZigZag32(const char** p) {
  576. uint64 tmp;
  577. *p = VarintParse(*p, &tmp);
  578. return WireFormatLite::ZigZagDecode32(static_cast<uint32>(tmp));
  579. }
  580. template <typename T>
  581. PROTOBUF_MUST_USE_RESULT const char* ParseContext::ParseMessage(
  582. T* msg, const char* ptr) {
  583. int size = ReadSize(&ptr);
  584. if (!ptr) return nullptr;
  585. auto old = PushLimit(ptr, size);
  586. if (--depth_ < 0) return nullptr;
  587. ptr = msg->_InternalParse(ptr, this);
  588. if (PROTOBUF_PREDICT_FALSE(ptr == nullptr)) return nullptr;
  589. depth_++;
  590. if (!PopLimit(old)) return nullptr;
  591. return ptr;
  592. }
  593. template <typename Add>
  594. const char* ReadPackedVarintArray(const char* ptr, const char* end, Add add) {
  595. while (ptr < end) {
  596. uint64 varint;
  597. ptr = VarintParse(ptr, &varint);
  598. if (ptr == nullptr) return nullptr;
  599. add(varint);
  600. }
  601. return ptr;
  602. }
  603. template <typename Add>
  604. const char* EpsCopyInputStream::ReadPackedVarint(const char* ptr, Add add) {
  605. int size = ReadSize(&ptr);
  606. if (ptr == nullptr) return nullptr;
  607. int chunk_size = buffer_end_ - ptr;
  608. while (size > chunk_size) {
  609. ptr = ReadPackedVarintArray(ptr, buffer_end_, add);
  610. if (ptr == nullptr) return nullptr;
  611. int overrun = ptr - buffer_end_;
  612. GOOGLE_DCHECK(overrun >= 0 && overrun <= kSlopBytes);
  613. if (size - chunk_size <= kSlopBytes) {
  614. // The current buffer contains all the information needed, we don't need
  615. // to flip buffers. However we must parse from a buffer with enough space
  616. // so we are not prone to a buffer overflow.
  617. char buf[kSlopBytes + 10] = {};
  618. std::memcpy(buf, buffer_end_, kSlopBytes);
  619. GOOGLE_CHECK_LE(size - chunk_size, kSlopBytes);
  620. auto end = buf + (size - chunk_size);
  621. auto res = ReadPackedVarintArray(buf + overrun, end, add);
  622. if (res == nullptr || res != end) return nullptr;
  623. return buffer_end_ + (res - buf);
  624. }
  625. size -= overrun + chunk_size;
  626. GOOGLE_DCHECK_GT(size, 0);
  627. // We must flip buffers
  628. if (limit_ <= kSlopBytes) return nullptr;
  629. ptr = Next();
  630. if (ptr == nullptr) return nullptr;
  631. ptr += overrun;
  632. chunk_size = buffer_end_ - ptr;
  633. }
  634. auto end = ptr + size;
  635. ptr = ReadPackedVarintArray(ptr, end, add);
  636. return end == ptr ? ptr : nullptr;
  637. }
  638. // Helper for verification of utf8
  639. PROTOBUF_EXPORT
  640. bool VerifyUTF8(StringPiece s, const char* field_name);
  641. inline bool VerifyUTF8(const std::string* s, const char* field_name) {
  642. return VerifyUTF8(*s, field_name);
  643. }
  644. // All the string parsers with or without UTF checking and for all CTypes.
  645. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* InlineGreedyStringParser(
  646. std::string* s, const char* ptr, ParseContext* ctx);
  647. // Add any of the following lines to debug which parse function is failing.
  648. #define GOOGLE_PROTOBUF_ASSERT_RETURN(predicate, ret) \
  649. if (!(predicate)) { \
  650. /* ::raise(SIGINT); */ \
  651. /* GOOGLE_LOG(ERROR) << "Parse failure"; */ \
  652. return ret; \
  653. }
  654. #define GOOGLE_PROTOBUF_PARSER_ASSERT(predicate) \
  655. GOOGLE_PROTOBUF_ASSERT_RETURN(predicate, nullptr)
  656. template <typename T>
  657. PROTOBUF_MUST_USE_RESULT const char* FieldParser(uint64 tag, T& field_parser,
  658. const char* ptr,
  659. ParseContext* ctx) {
  660. uint32 number = tag >> 3;
  661. GOOGLE_PROTOBUF_PARSER_ASSERT(number != 0);
  662. using WireType = internal::WireFormatLite::WireType;
  663. switch (tag & 7) {
  664. case WireType::WIRETYPE_VARINT: {
  665. uint64 value;
  666. ptr = VarintParse(ptr, &value);
  667. GOOGLE_PROTOBUF_PARSER_ASSERT(ptr);
  668. field_parser.AddVarint(number, value);
  669. break;
  670. }
  671. case WireType::WIRETYPE_FIXED64: {
  672. uint64 value = UnalignedLoad<uint64>(ptr);
  673. ptr += 8;
  674. field_parser.AddFixed64(number, value);
  675. break;
  676. }
  677. case WireType::WIRETYPE_LENGTH_DELIMITED: {
  678. ptr = field_parser.ParseLengthDelimited(number, ptr, ctx);
  679. GOOGLE_PROTOBUF_PARSER_ASSERT(ptr);
  680. break;
  681. }
  682. case WireType::WIRETYPE_START_GROUP: {
  683. ptr = field_parser.ParseGroup(number, ptr, ctx);
  684. GOOGLE_PROTOBUF_PARSER_ASSERT(ptr);
  685. break;
  686. }
  687. case WireType::WIRETYPE_END_GROUP: {
  688. GOOGLE_LOG(FATAL) << "Can't happen";
  689. break;
  690. }
  691. case WireType::WIRETYPE_FIXED32: {
  692. uint32 value = UnalignedLoad<uint32>(ptr);
  693. ptr += 4;
  694. field_parser.AddFixed32(number, value);
  695. break;
  696. }
  697. default:
  698. return nullptr;
  699. }
  700. return ptr;
  701. }
  702. template <typename T>
  703. PROTOBUF_MUST_USE_RESULT const char* WireFormatParser(T& field_parser,
  704. const char* ptr,
  705. ParseContext* ctx) {
  706. while (!ctx->Done(&ptr)) {
  707. uint32 tag;
  708. ptr = ReadTag(ptr, &tag);
  709. GOOGLE_PROTOBUF_PARSER_ASSERT(ptr != nullptr);
  710. if (tag == 0 || (tag & 7) == 4) {
  711. ctx->SetLastTag(tag);
  712. return ptr;
  713. }
  714. ptr = FieldParser(tag, field_parser, ptr, ctx);
  715. GOOGLE_PROTOBUF_PARSER_ASSERT(ptr != nullptr);
  716. }
  717. return ptr;
  718. }
  719. // The packed parsers parse repeated numeric primitives directly into the
  720. // corresponding field
  721. // These are packed varints
  722. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedInt32Parser(
  723. void* object, const char* ptr, ParseContext* ctx);
  724. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedUInt32Parser(
  725. void* object, const char* ptr, ParseContext* ctx);
  726. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedInt64Parser(
  727. void* object, const char* ptr, ParseContext* ctx);
  728. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedUInt64Parser(
  729. void* object, const char* ptr, ParseContext* ctx);
  730. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedSInt32Parser(
  731. void* object, const char* ptr, ParseContext* ctx);
  732. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedSInt64Parser(
  733. void* object, const char* ptr, ParseContext* ctx);
  734. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedEnumParser(
  735. void* object, const char* ptr, ParseContext* ctx);
  736. template <typename T>
  737. PROTOBUF_MUST_USE_RESULT const char* PackedEnumParser(
  738. void* object, const char* ptr, ParseContext* ctx, bool (*is_valid)(int),
  739. InternalMetadata* metadata, int field_num) {
  740. return ctx->ReadPackedVarint(
  741. ptr, [object, is_valid, metadata, field_num](uint64 val) {
  742. if (is_valid(val)) {
  743. static_cast<RepeatedField<int>*>(object)->Add(val);
  744. } else {
  745. WriteVarint(field_num, val, metadata->mutable_unknown_fields<T>());
  746. }
  747. });
  748. }
  749. template <typename T>
  750. PROTOBUF_MUST_USE_RESULT const char* PackedEnumParserArg(
  751. void* object, const char* ptr, ParseContext* ctx,
  752. bool (*is_valid)(const void*, int), const void* data,
  753. InternalMetadata* metadata, int field_num) {
  754. return ctx->ReadPackedVarint(
  755. ptr, [object, is_valid, data, metadata, field_num](uint64 val) {
  756. if (is_valid(data, val)) {
  757. static_cast<RepeatedField<int>*>(object)->Add(val);
  758. } else {
  759. WriteVarint(field_num, val, metadata->mutable_unknown_fields<T>());
  760. }
  761. });
  762. }
  763. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedBoolParser(
  764. void* object, const char* ptr, ParseContext* ctx);
  765. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedFixed32Parser(
  766. void* object, const char* ptr, ParseContext* ctx);
  767. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedSFixed32Parser(
  768. void* object, const char* ptr, ParseContext* ctx);
  769. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedFixed64Parser(
  770. void* object, const char* ptr, ParseContext* ctx);
  771. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedSFixed64Parser(
  772. void* object, const char* ptr, ParseContext* ctx);
  773. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedFloatParser(
  774. void* object, const char* ptr, ParseContext* ctx);
  775. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* PackedDoubleParser(
  776. void* object, const char* ptr, ParseContext* ctx);
  777. // This is the only recursive parser.
  778. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* UnknownGroupLiteParse(
  779. std::string* unknown, const char* ptr, ParseContext* ctx);
  780. // This is a helper to for the UnknownGroupLiteParse but is actually also
  781. // useful in the generated code. It uses overload on std::string* vs
  782. // UnknownFieldSet* to make the generated code isomorphic between full and lite.
  783. PROTOBUF_EXPORT PROTOBUF_MUST_USE_RESULT const char* UnknownFieldParse(
  784. uint32 tag, std::string* unknown, const char* ptr, ParseContext* ctx);
  785. } // namespace internal
  786. } // namespace protobuf
  787. } // namespace google
  788. #include <google/protobuf/port_undef.inc>
  789. #endif // GOOGLE_PROTOBUF_PARSE_CONTEXT_H__