commit 217c0306ee376a8a9c05e72fc90cffab6b60e66a
author Ömer Sinan Ağacan <omersa@google.com> Wed Aug 02 09:24:08 2023 +0200
committer GitHub <noreply@github.com> Wed Aug 02 09:24:08 2023 +0200
tree 6709bc912ca0c849bc8bf4b1fe2b0da773f0fd7b
parent d9e8a31d0e4124130fc494b6bdb66e19dbd4770d

Avoid holding onto the buffer when parsing unknown length-delimited fields (#863)

Currently unknown field set parser stores length-delimited fields as
views of the input buffer. This has a few issues:

- It's inconsistent with the known-field parsing where we copy `bytes`
fields.

- A single unknown length-delimited field can cause keeping a large
input buffer alive.

- Because the caller is free to modify the input buffer, this
implementation does not allow freezing an unknown field set.

(This can also be fixed by copying the length-delimited fields when
freezing.)

- Even when the parsed message is not frozen, this aliasing can cause
bugs as it's not documented. Even if we document it, it would probably
be a footgun.

This can cause segfaults or worse when the input buffer is passed from
e.g. C++ or C as a `Uint8List`, and the caller frees the buffer after
parsing while the message is still in use.

This PR makes `readBytes` copy the bytes before returning to avoid
aliasing. A new member `readBytesAsView` added with the previous
behavior. Unknown length-delimited field parsing fixed with the new
`readBytes`.

Sync CL: cl/552077275