Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions any.cc
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
// Protocol Buffers - Google's data interchange format
// Copyright 2008 Google Inc. All rights reserved.
// https://developers.google.com/protocol-buffers/
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "google/protobuf/any.h"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 1) 仓库内是否存在 protobuf 相关头文件 =="
fd -i 'any.h' | sed -n '1,40p'

echo "== 2) 构建脚本是否声明 protobuf 依赖 =="
rg -n -C2 \
  --iglob 'CMakeLists.txt' \
  --iglob 'BUILD*' \
  --iglob '*.bazel' \
  --iglob 'WORKSPACE*' \
  --iglob 'MODULE.bazel' \
  --iglob 'Makefile*' \
  --iglob '*.gn' \
  'protobuf|libprotobuf|find_package\(Protobuf|google/protobuf|FetchContent.*protobuf'

echo "== 3) any.cc 是否被加入构建目标 =="
rg -n -C2 \
  --iglob 'CMakeLists.txt' \
  --iglob 'BUILD*' \
  --iglob '*.bazel' \
  --iglob 'Makefile*' \
  --iglob '*.gn' \
  'any\.cc'

Repository: SoftSec-Tech/big_num_cal

Length of output: 130


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 检查 any.cc 是否存在 =="
find . -name 'any.cc' -o -name 'any.cc*'

echo "== 列出仓库顶级结构 =="
ls -la | head -20

echo "== 查找所有 C/C++ 源文件 =="
fd -e cc -e cpp -e h -e hpp | head -30

echo "== 查看 CMakeLists.txt 内容(如果存在)=="
if [ -f CMakeLists.txt ]; then
  head -50 CMakeLists.txt
else
  echo "CMakeLists.txt 不存在"
fi

Repository: SoftSec-Tech/big_num_cal

Length of output: 1007


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== any.cc 的前 40 行内容 =="
head -40 any.cc

echo ""
echo "== Makefile 完整内容 =="
cat Makefile

echo ""
echo "== any.cc 第 25-35 行(确认第 31 行)=="
sed -n '25,35p' any.cc | cat -n

Repository: SoftSec-Tech/big_num_cal

Length of output: 2908


补齐 Protobuf 依赖声明并将 any.cc 集成到构建系统,否则会阻塞编译。

any.cc 第 31 行引入 google/protobuf/any.h,但当前 Makefile 中缺少以下内容:

  1. Protobuf 依赖的声明(编译标志、链接库等)
  2. any.cc 的编译目标和链接规则

any.cc 被添加到仓库但尚未集成到构建系统,直接尝试编译会因无法找到 protobuf 头文件而失败。

建议在 Makefile 中添加 protobuf 依赖配置和 any.cc 的编译规则(例如通过 pkg-config --cflags --libs protobuf)。

🧰 Tools
🪛 Clang (14.0.6)

[error] 31-31: 'google/protobuf/any.h' file not found

(clang-diagnostic-error)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@any.cc` at line 31, any.cc includes google/protobuf/any.h but the build lacks
Protobuf flags and a target for any.cc; update the Makefile to (1) add Protobuf
compile/link flags (e.g., from pkg-config --cflags --libs protobuf) to
CXXFLAGS/LDFLAGS or a PROTOBUF_CFLAGS/PROTOBUF_LIBS variable and (2) add a build
rule that compiles any.cc into the final binary or library (reference the source
file any.cc and the include google/protobuf/any.h) so the compiler can find
headers and link the protobuf library.


#include "google/protobuf/arenastring.h"
#include "google/protobuf/descriptor.h"
#include "google/protobuf/generated_message_util.h"
#include "google/protobuf/message.h"

// Must be included last.
#include "google/protobuf/port_def.inc"

namespace google {
namespace protobuf {
namespace internal {

bool AnyMetadata::PackFrom(Arena* arena, const Message& message) {
return PackFrom(arena, message, kTypeGoogleApisComPrefix);
}

bool AnyMetadata::PackFrom(Arena* arena, const Message& message,
absl::string_view type_url_prefix) {
type_url_->Set(
GetTypeUrl(message.GetDescriptor()->full_name(), type_url_prefix), arena);
return message.SerializeToString(value_->Mutable(arena));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

line 51-52 处先更新了 type_url_,但 line 53 处才序列化 value_。如果 SerializeToString 失败(返回 false),type_url_ 已经被修改,导致对象处于不一致状态:类型 URL 指向新消息,但值字段仍保留旧数据或为空。

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 53

💬 详细说明:

  • 当序列化失败时,Any 对象会处于损坏状态,后续解包或检查类型时会得到错误结果或崩溃。

📝 问题代码:

  return message.SerializeToString(value_->Mutable(arena));

💡 修复建议:

应先序列化消息到临时变量,成功后再同时更新 type_url_ 和 value_。或者在序列化失败时回滚 type_url_ 的更改。

✅ 修复示例:

bool AnyMetadata::PackFrom(Arena* arena, const Message& message,
                           absl::string_view type_url_prefix) {
  std::string serialized;
  if (!message.SerializeToString(&serialized)) {
    return false;
  }
  type_url_->Set(
      GetTypeUrl(message.GetDescriptor()->full_name(), type_url_prefix), arena);
  value_->Set(serialized, arena);
  return true;
}

🔗 参考链接

}

bool AnyMetadata::UnpackTo(Message* message) const {
if (!InternalIs(message->GetDescriptor()->full_name())) {
return false;
}
return message->ParseFromString(value_->Get());
}

bool GetAnyFieldDescriptors(const Message& message,
const FieldDescriptor** type_url_field,
const FieldDescriptor** value_field) {
const Descriptor* descriptor = message.GetDescriptor();
if (descriptor->full_name() != kAnyFullTypeName) {
return false;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 AI 代码审查发现问题

📋 问题概述

在 GetAnyFieldDescriptors 函数中,当 line 67 判断消息类型不匹配时,于 line 68 直接返回 false。此时输出参数 type_url_field 和 value_field 未被初始化或赋值。如果调用者未检查返回值直接使用这些指针,将导致未定义行为(如空指针解引用或使用随机值)。

【本轮 diff 审查结论】
GetAnyFieldDescriptors 函数在 line 67 判断消息类型不匹配时,于 line 68 直接返回 false,但未对输出参数 type_url_field 和 value_field 进行初始化赋值。当调用方传入未初始化的局部指针变量时,函数返回后这些指针仍保持栈上的垃圾值,后续若未严格检查返回值而误用,将引发未定义行为(如空指针解引用或内存越界)。

📍 问题详情

🟡 问题 1 | 严重程度: MEDIUM | 行号: 68

💬 详细说明:

  • 调用者在忽略返回值的情况下使用未初始化的输出参数,可能导致程序崩溃或数据损坏。

📝 问题代码:

    return false;

💡 修复建议:

在返回 false 之前,应将输出参数设置为 nullptr,以确保调用者在使用前有明确的检查依据。

✅ 修复示例:

  if (descriptor->full_name() != kAnyFullTypeName) {
    *type_url_field = nullptr;
    *value_field = nullptr;
    return false;
  }

🔗 参考链接

}
*type_url_field = descriptor->FindFieldByNumber(1);
*value_field = descriptor->FindFieldByNumber(2);
return (*type_url_field != nullptr &&
(*type_url_field)->type() == FieldDescriptor::TYPE_STRING &&
*value_field != nullptr &&
(*value_field)->type() == FieldDescriptor::TYPE_BYTES);
}

} // namespace internal
} // namespace protobuf
} // namespace google

#include "google/protobuf/port_undef.inc"