Fix: Check flatbuffer integrity before parsing (#1864)

* Fix: Check flatbuffer integrity before parsing

Updated flatbuffer to latest version to get verify buffer
Use strol for key parsing to ensure exceptions do not result in a crash.

* Handle new FBT_MAX_TYPE in flatbuffers

* Fix the GenerateText response

* Patch flatbuffers to resolve ERROR macro conflict on Windows

* Add release notes

* Restore 0001-remove-unused-var.patch for Android flatbuffers v1.12.0 build

* Use cp -RL on Windows to avoid symbolic link creation failure

* Address code review feedback on remote_config desktop implementation

* Revert minor whitespace change in 0001-remove-unused-var.patch

* Add default case to FlexbufferToVariant switch to handle unknown/corrupt types

* Fix incorrect GenerateText return value comparison to nullptr

* Add default case to FlexbufferToVariant switches in app and database modules

* Avoid leading slash in app_data_prefix when package_name is empty/null

* Add defensive null check for configs in RemoteConfigFileManager::Load

* Fix logic inversion in RequestJson serialization assertion

* Pin flatbuffers to official v25.12.19 release commit 7e163021

* Unify C++ and Java FlatBuffers versions to v25.2.10

* Update FlatBuffers patch for v25.2.10 formatting compatibility on Windows

* Update Release Notes in readme.md for FlatBuffers v25.2.10 upgrade

Author: AustinBenoit

app/rest/request_json.h

@@ -66,7 +66,7 @@ class RequestJson : public Request {
     // Generate JSON string.
     std::string json;
     bool generate_status =
-        GenerateText(*parser_, builder.GetBufferPointer(), &json);
+        GenerateText(*parser_, builder.GetBufferPointer(), &json) == nullptr;
     FIREBASE_ASSERT_RETURN_VOID(generate_status);
 
     set_post_fields(json.c_str());

app/src/variant_util.cc

@@ -250,6 +250,11 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) {
     case flexbuffers::FBT_BLOB:
       LogError("Flexbuffers containing blobs are not supported.");
       break;
+    case flexbuffers::FBT_MAX_TYPE:
+    default:
+      LogError("Unknown or unsupported flexbuffer type: %d",
+               static_cast<int>(ref.GetType()));
+      break;
   }
   return Variant::Null();
 }

build_scripts/android/build.sh

@@ -81,6 +81,5 @@ if [[ $(uname) == "Linux" ]] || [[ $(uname) == "Darwin" ]]; then
 else
   # rsync has to be specifically installed on windows bash (including github runners)
   # Also, rsync with absolute destination path doesn't work on Windows.
-  # Using a simple copy instead of rsync on Windows.
-  cp -R --parents "${paths[@]}" "${absbuildpath}"
+  cp -RL --parents "${paths[@]}" "${absbuildpath}"
 fi

cmake/external/flatbuffers.cmake

@@ -18,9 +18,10 @@ if(TARGET flatbuffers OR NOT DOWNLOAD_FLATBUFFERS)
   return()
 endif()
 
-set(version 99aa1ef21dd9dc3f9d4fb0eb82f4b59d0bb5e4c5)
+# Pinned to the official v25.2.10 release commit to ensure stability and match Java library.
+set(version 1c514626e83c20fffa8557e75641848e1e15cd5e)
 set(patch_file
-  ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-remove-unused-var.patch)
+  ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-fix-error-macro.patch)
 
 ExternalProject_Add(
   flatbuffers
@@ -29,7 +30,7 @@ ExternalProject_Add(
     COMMAND git init flatbuffers
     COMMAND cd flatbuffers && git fetch --depth=1 https://github.com/google/flatbuffers.git ${version} && git reset --hard FETCH_HEAD
 
-  PATCH_COMMAND git apply ${patch_file} && git gc --aggressive
+  PATCH_COMMAND git apply ${patch_file}
   PREFIX ${PROJECT_BINARY_DIR}
 
   CONFIGURE_COMMAND ""

database/src/desktop/persistence/flatbuffer_conversions.cc

@@ -103,6 +103,11 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) {
     case flexbuffers::FBT_BLOB:
       LogError("Flexbuffers containing blobs are not supported.");
       break;
+    case flexbuffers::FBT_MAX_TYPE:
+    default:
+      LogError("Unknown or unsupported flexbuffer type: %d",
+               static_cast<int>(ref.GetType()));
+      break;
   }
   return Variant::Null();
 }

messaging/messaging_java/build.gradle

@@ -20,11 +20,7 @@ buildscript {
   dependencies {
     classpath 'com.android.tools.build:gradle:7.4.2'
     classpath 'com.google.gms:google-services:4.4.1'
-    // This uses Flatbuffers at 1.9 because the 1.10 version added a feature
-    // that requires using a newer version of the JDK and at least Android N.
-    // This has already been fixed at head, but a tagged release is not yet
-    // available with that fix.
-    classpath 'com.google.flatbuffers:flatbuffers-java:1.12.0'
+    classpath 'com.google.flatbuffers:flatbuffers-java:25.2.10'
   }
 }
 allprojects {
@@ -64,7 +60,7 @@ dependencies {
   implementation platform('com.google.firebase:firebase-bom:34.15.0')
   implementation 'com.google.firebase:firebase-analytics'
   implementation 'com.google.firebase:firebase-messaging'
-  implementation 'com.google.flatbuffers:flatbuffers-java:1.12.0'
+  implementation 'com.google.flatbuffers:flatbuffers-java:25.2.10'
 }
 
 afterEvaluate {
@@ -81,20 +77,13 @@ afterEvaluate {
         executable 'git'
         args 'clone',
              '--branch',
-             'v1.12.0',
+             'v25.2.10',
              '--depth',
              '1',
              'https://github.com/google/flatbuffers.git',
              flatbuffersDir
       }
-      exec {
-        executable 'git'
-        args 'apply',
-             '../../scripts/git/patches/flatbuffers/0001-remove-unused-var.patch',
-             '--verbose',
-             '--directory',
-             'messaging/messaging_java/build/flatbuffers'
-        }
+
     }
 
     // Locate or build flatc.

release_build_files/readme.md

@@ -613,6 +613,11 @@ workflow use only during the development of your app, not for publicly shipping
 code.
 
 ## Release Notes
+### Upcoming
+- Changes
+    - General: Upgraded FlatBuffers dependency to v25.2.10 across both native C++ and Java/Android components.
+    - Remote Config (Desktop): Added flexbuffer integrity checks before parsing to prevent crashes on invalid/malformed data.
+
 ### 13.9.0
 - Changes
     - General (Android): Update to Firebase Android BoM version 34.15.0.

remote_config/src/desktop/config_data.cc

@@ -51,6 +51,9 @@ std::string NamespacedConfigData::Serialize() const {
 void NamespacedConfigData::Deserialize(const std::string& buffer) {
   const uint8_t* data = reinterpret_cast<const uint8_t*>(buffer.data());
   size_t size = buffer.size();
+  if (!flexbuffers::VerifyBuffer(data, size)) {
+    return;
+  }
   auto struct_map = flexbuffers::GetRoot(data, size).AsMap();
   flexbuffers::Map ns_config_map = struct_map["config_"].AsMap();
   for (int i = 0, in = ns_config_map.size(); i < in; ++i) {
@@ -144,6 +147,9 @@ std::string LayeredConfigs::Serialize() const {
 void LayeredConfigs::Deserialize(const std::string& buffer) {
   const uint8_t* data = reinterpret_cast<const uint8_t*>(buffer.data());
   size_t size = buffer.size();
+  if (!flexbuffers::VerifyBuffer(data, size)) {
+    return;
+  }
   auto struct_map = flexbuffers::GetRoot(data, size).AsMap();
   fetched.Deserialize(struct_map["fetched"].AsString().str());
   active.Deserialize(struct_map["active"].AsString().str());

remote_config/src/desktop/file_manager.cc

@@ -36,11 +36,18 @@ namespace internal {
 
 RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename,
                                                  const firebase::App& app) {
+  const char* package_name = app.options().package_name();
   std::string app_data_prefix =
-      std::string(app.options().package_name()) + "/" + app.name();
-  std::string file_path =
-      AppDataDir(app_data_prefix.c_str(), /*should_create=*/true) + "/" +
-      filename;
+      (package_name && package_name[0] != '\0')
+          ? std::string(package_name) + "/remote_config"
+          : "remote_config";
+  std::string error;
+  std::string app_dir =
+      AppDataDir(app_data_prefix.c_str(), /*should_create=*/true, &error);
+  std::string file_path;
+  if (error.empty() && !app_dir.empty()) {
+    file_path = app_dir + "/" + app.name() + "_" + filename;
+  }
 #if FIREBASE_PLATFORM_WINDOWS
   std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> utf8_to_wstring;
   file_path_ = utf8_to_wstring.from_bytes(file_path);
@@ -50,16 +57,28 @@ RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename,
 }
 
 bool RemoteConfigFileManager::Load(LayeredConfigs* configs) const {
+  if (!configs || file_path_.empty()) {
+    return false;
+  }
   std::fstream input(file_path_, std::ios::in | std::ios::binary);
+  if (!input) {
+    return false;
+  }
   std::stringstream ss;
   ss << input.rdbuf();
   configs->Deserialize(ss.str());
   return true;
 }
 
 bool RemoteConfigFileManager::Save(const LayeredConfigs& configs) const {
+  if (file_path_.empty()) {
+    return false;
+  }
   std::string buffer = configs.Serialize();
   std::fstream output(file_path_, std::ios::out | std::ios::binary);
+  if (!output) {
+    return false;
+  }
   output.write(buffer.c_str(), buffer.size());
   return true;
 }

remote_config/src/desktop/metadata.cc

@@ -14,7 +14,10 @@
 
 #include "remote_config/src/desktop/metadata.h"
 
+#include <cerrno>
 #include <cstdint>
+#include <cstdlib>
+#include <limits>
 #include <map>
 #include <string>
 
@@ -59,6 +62,9 @@ std::string RemoteConfigMetadata::Serialize() const {
 void RemoteConfigMetadata::Deserialize(const std::string& buffer) {
   const uint8_t* data = reinterpret_cast<const uint8_t*>(buffer.data());
   size_t size = buffer.size();
+  if (!flexbuffers::VerifyBuffer(data, size)) {
+    return;
+  }
   auto struct_map = flexbuffers::GetRoot(data, size).AsMap();
 
   flexbuffers::Map info = struct_map["info"].AsMap();
@@ -76,7 +82,19 @@ void RemoteConfigMetadata::Deserialize(const std::string& buffer) {
   settings_.clear();
   flexbuffers::Map settings = struct_map["settings"].AsMap();
   for (int i = 0, n = settings.size(); i < n; ++i) {
-    int int_key = std::stoi(settings.Keys()[i].AsKey());
+    const char* key_str = settings.Keys()[i].AsKey();
+    if (!key_str) continue;
+    char* endptr = nullptr;
+    errno = 0;
+    long raw_key = std::strtol(key_str, &endptr, 10);
+    if (endptr == key_str || *endptr != '\0' || errno == ERANGE) {
+      continue;
+    }
+    if (raw_key < std::numeric_limits<int>::min() ||
+        raw_key > std::numeric_limits<int>::max()) {
+      continue;
+    }
+    int int_key = static_cast<int>(raw_key);
     settings_[static_cast<ConfigSetting>(int_key)] =
         settings.Values()[i].AsString().c_str();
   }