grpc 1.48.0-x86_64-linux → 1.49.1-x86_64-linux

data/third_party/upb/upb/collections.h

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2009-2021, Google LLC
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Google LLC nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL Google LLC BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UPB_COLLECTIONS_H_
+#define UPB_COLLECTIONS_H_
+
+// TODO(b/232091617): Delete this entire header which currently exists only for
+// temporary backwards compatibility.
+#include "upb/array.h"
+#include "upb/map.h"
+
+#endif /* UPB_COLLECTIONS_H_ */

data/third_party/upb/upb/decode.c

@@ -30,9 +30,9 @@
 #include <setjmp.h>
 #include <string.h>
 
-#include "upb/decode_internal.h"
+#include "upb/internal/decode.h"
+#include "upb/internal/upb.h"
 #include "upb/upb.h"
-#include "upb/upb_internal.h"
 
 /* Must be last. */
 #include "upb/port_def.inc"
@@ -93,13 +93,11 @@ static const unsigned FIXED64_OK_MASK = (1 << kUpb_FieldType_Double) |
 
 /* Three fake field types for MessageSet. */
 #define TYPE_MSGSET_ITEM 19
-#define TYPE_MSGSET_TYPE_ID 20
-#define TYPE_COUNT 20
+#define TYPE_COUNT 19
 
 /* Op: an action to be performed for a wire-type/field-type combination. */
 #define OP_UNKNOWN -1 /* Unknown field. */
 #define OP_MSGSET_ITEM -2
-#define OP_MSGSET_TYPEID -3
 #define OP_SCALAR_LG2(n) (n) /* n in [0, 2, 3] => op in [0, 2, 3] */
 #define OP_ENUM 1
 #define OP_STRING 4
@@ -131,7 +129,6 @@ static const int8_t varint_ops[] = {
     OP_SCALAR_LG2(2), /* SINT32 */
     OP_SCALAR_LG2(3), /* SINT64 */
     OP_UNKNOWN,       /* MSGSET_ITEM */
-    OP_MSGSET_TYPEID, /* MSGSET TYPEID */
 };
 
 static const int8_t delim_ops[] = {
@@ -156,7 +153,6 @@ static const int8_t delim_ops[] = {
     OP_UNKNOWN, /* SINT32 */
     OP_UNKNOWN, /* SINT64 */
     OP_UNKNOWN, /* MSGSET_ITEM */
-    OP_UNKNOWN, /* MSGSET TYPEID */
     /* For repeated field type. */
     OP_FIXPCK_LG2(3), /* REPEATED DOUBLE */
     OP_FIXPCK_LG2(2), /* REPEATED FLOAT */
@@ -266,6 +262,18 @@ static const char* decode_tag(upb_Decoder* d, const char* ptr, uint32_t* val) {
   }
 }
 
+UPB_FORCEINLINE
+static const char* upb_Decoder_DecodeSize(upb_Decoder* d, const char* ptr,
+                                          uint32_t* size) {
+  uint64_t size64;
+  ptr = decode_varint64(d, ptr, &size64);
+  if (size64 >= INT32_MAX || ptr - d->end + (int)size64 > d->limit) {
+    decode_err(d, kUpb_DecodeStatus_Malformed);
+  }
+  *size = size64;
+  return ptr;
+}
+
 static void decode_munge_int32(wireval* val) {
   if (!_upb_IsLittleEndian()) {
     /* The next stage will memcpy(dst, &val, 4) */
@@ -300,7 +308,9 @@ static upb_Message* decode_newsubmsg(upb_Decoder* d,
                                      const upb_MiniTable_Sub* subs,
                                      const upb_MiniTable_Field* field) {
   const upb_MiniTable* subl = subs[field->submsg_index].submsg;
-  return _upb_Message_New_inl(subl, &d->arena);
+  upb_Message* msg = _upb_Message_New_inl(subl, &d->arena);
+  if (!msg) decode_err(d, kUpb_DecodeStatus_OutOfMemory);
+  return msg;
 }
 
 UPB_NOINLINE
@@ -375,7 +385,7 @@ static const char* decode_togroup(upb_Decoder* d, const char* ptr,
   return decode_group(d, ptr, submsg, subl, field->number);
 }
 
-static char* encode_varint32(uint32_t val, char* ptr) {
+static char* upb_Decoder_EncodeVarint32(uint32_t val, char* ptr) {
   do {
     uint8_t byte = val & 0x7fU;
     val >>= 7;
@@ -389,8 +399,8 @@ static void upb_Decode_AddUnknownVarints(upb_Decoder* d, upb_Message* msg,
                                          uint32_t val1, uint32_t val2) {
   char buf[20];
   char* end = buf;
-  end = encode_varint32(val1, end);
-  end = encode_varint32(val2, end);
+  end = upb_Decoder_EncodeVarint32(val1, end);
+  end = upb_Decoder_EncodeVarint32(val2, end);
 
   if (!_upb_Message_AddUnknown(msg, buf, end - buf, &d->arena)) {
     decode_err(d, kUpb_DecodeStatus_OutOfMemory);
@@ -643,7 +653,10 @@ static const char* decode_tomap(upb_Decoder* d, const char* ptr,
       decode_err(d, kUpb_DecodeStatus_OutOfMemory);
     }
   } else {
-    _upb_Map_Set(map, &ent.k, map->key_size, &ent.v, map->val_size, &d->arena);
+    if (_upb_Map_Insert(map, &ent.k, map->key_size, &ent.v, map->val_size,
+                        &d->arena) == _kUpb_MapInsertStatus_OutOfMemory) {
+      decode_err(d, kUpb_DecodeStatus_OutOfMemory);
+    }
   }
   return ptr;
 }
@@ -743,25 +756,139 @@ static bool decode_tryfastdispatch(upb_Decoder* d, const char** ptr,
   return false;
 }
 
-static const char* decode_msgset(upb_Decoder* d, const char* ptr,
-                                 upb_Message* msg,
-                                 const upb_MiniTable* layout) {
-  // We create a temporary upb_MiniTable here and abuse its fields as temporary
-  // storage, to avoid creating lots of MessageSet-specific parsing code-paths:
-  //   1. We store 'layout' in item_layout.subs.  We will need this later as
-  //      a key to look up extensions for this MessageSet.
-  //   2. We use item_layout.fields as temporary storage to store the extension
-  //   we
-  //      found when parsing the type id.
-  upb_MiniTable item_layout = {
-      .subs = (const upb_MiniTable_Sub[]){{.submsg = layout}},
-      .fields = NULL,
-      .size = 0,
-      .field_count = 0,
-      .ext = kUpb_ExtMode_IsMessageSet_ITEM,
-      .dense_below = 0,
-      .table_mask = -1};
-  return decode_group(d, ptr, msg, &item_layout, 1);
+static const char* upb_Decoder_SkipField(upb_Decoder* d, const char* ptr,
+                                         uint32_t tag) {
+  int field_number = tag >> 3;
+  int wire_type = tag & 7;
+  switch (wire_type) {
+    case kUpb_WireType_Varint: {
+      uint64_t val;
+      return decode_varint64(d, ptr, &val);
+    }
+    case kUpb_WireType_64Bit:
+      return ptr + 8;
+    case kUpb_WireType_32Bit:
+      return ptr + 4;
+    case kUpb_WireType_Delimited: {
+      uint32_t size;
+      ptr = upb_Decoder_DecodeSize(d, ptr, &size);
+      return ptr + size;
+    }
+    case kUpb_WireType_StartGroup:
+      return decode_group(d, ptr, NULL, NULL, field_number);
+    default:
+      decode_err(d, kUpb_DecodeStatus_Malformed);
+  }
+}
+
+enum {
+  kStartItemTag = ((1 << 3) | kUpb_WireType_StartGroup),
+  kEndItemTag = ((1 << 3) | kUpb_WireType_EndGroup),
+  kTypeIdTag = ((2 << 3) | kUpb_WireType_Varint),
+  kMessageTag = ((3 << 3) | kUpb_WireType_Delimited),
+};
+
+static void upb_Decoder_AddKnownMessageSetItem(
+    upb_Decoder* d, upb_Message* msg, const upb_MiniTable_Extension* item_mt,
+    const char* data, uint32_t size) {
+  upb_Message_Extension* ext =
+      _upb_Message_GetOrCreateExtension(msg, item_mt, &d->arena);
+  if (UPB_UNLIKELY(!ext)) decode_err(d, kUpb_DecodeStatus_OutOfMemory);
+  upb_Message* submsg = decode_newsubmsg(d, &ext->ext->sub, &ext->ext->field);
+  upb_DecodeStatus status = upb_Decode(data, size, submsg, item_mt->sub.submsg,
+                                       d->extreg, d->options, &d->arena);
+  memcpy(&ext->data, &submsg, sizeof(submsg));
+  if (status != kUpb_DecodeStatus_Ok) decode_err(d, status);
+}
+
+static void upb_Decoder_AddUnknownMessageSetItem(upb_Decoder* d,
+                                                 upb_Message* msg,
+                                                 uint32_t type_id,
+                                                 const char* message_data,
+                                                 uint32_t message_size) {
+  char buf[60];
+  char* ptr = buf;
+  ptr = upb_Decoder_EncodeVarint32(kStartItemTag, ptr);
+  ptr = upb_Decoder_EncodeVarint32(kTypeIdTag, ptr);
+  ptr = upb_Decoder_EncodeVarint32(type_id, ptr);
+  ptr = upb_Decoder_EncodeVarint32(kMessageTag, ptr);
+  ptr = upb_Decoder_EncodeVarint32(message_size, ptr);
+  char* split = ptr;
+
+  ptr = upb_Decoder_EncodeVarint32(kEndItemTag, ptr);
+  char* end = ptr;
+
+  if (!_upb_Message_AddUnknown(msg, buf, split - buf, &d->arena) ||
+      !_upb_Message_AddUnknown(msg, message_data, message_size, &d->arena) ||
+      !_upb_Message_AddUnknown(msg, split, end - split, &d->arena)) {
+    decode_err(d, kUpb_DecodeStatus_OutOfMemory);
+  }
+}
+
+static void upb_Decoder_AddMessageSetItem(upb_Decoder* d, upb_Message* msg,
+                                          const upb_MiniTable* layout,
+                                          uint32_t type_id, const char* data,
+                                          uint32_t size) {
+  const upb_MiniTable_Extension* item_mt =
+      _upb_extreg_get(d->extreg, layout, type_id);
+  if (item_mt) {
+    upb_Decoder_AddKnownMessageSetItem(d, msg, item_mt, data, size);
+  } else {
+    upb_Decoder_AddUnknownMessageSetItem(d, msg, type_id, data, size);
+  }
+}
+
+static const char* upb_Decoder_DecodeMessageSetItem(
+    upb_Decoder* d, const char* ptr, upb_Message* msg,
+    const upb_MiniTable* layout) {
+  uint32_t type_id = 0;
+  upb_StringView preserved = {NULL, 0};
+  typedef enum {
+    kUpb_HaveId = 1 << 0,
+    kUpb_HavePayload = 1 << 1,
+  } StateMask;
+  StateMask state_mask = 0;
+  while (!decode_isdone(d, &ptr)) {
+    uint32_t tag;
+    ptr = decode_tag(d, ptr, &tag);
+    switch (tag) {
+      case kEndItemTag:
+        return ptr;
+      case kTypeIdTag: {
+        uint64_t tmp;
+        ptr = decode_varint64(d, ptr, &tmp);
+        if (state_mask & kUpb_HaveId) break;  // Ignore dup.
+        state_mask |= kUpb_HaveId;
+        type_id = tmp;
+        if (state_mask & kUpb_HavePayload) {
+          upb_Decoder_AddMessageSetItem(d, msg, layout, type_id, preserved.data,
+                                        preserved.size);
+        }
+        break;
+      }
+      case kMessageTag: {
+        uint32_t size;
+        ptr = upb_Decoder_DecodeSize(d, ptr, &size);
+        const char* data = ptr;
+        ptr += size;
+        if (state_mask & kUpb_HavePayload) break;  // Ignore dup.
+        state_mask |= kUpb_HavePayload;
+        if (state_mask & kUpb_HaveId) {
+          upb_Decoder_AddMessageSetItem(d, msg, layout, type_id, data, size);
+        } else {
+          // Out of order, we must preserve the payload.
+          preserved.data = data;
+          preserved.size = size;
+        }
+        break;
+      }
+      default:
+        // We do not preserve unexpected fields inside a message set item.
+        ptr = upb_Decoder_SkipField(d, ptr, tag);
+        break;
+    }
+  }
+  decode_err(d, kUpb_DecodeStatus_Malformed);
 }
 
 static const upb_MiniTable_Field* decode_findfield(upb_Decoder* d,
@@ -808,26 +935,6 @@ static const upb_MiniTable_Field* decode_findfield(upb_Decoder* d,
           return &item;
         }
         break;
-      case kUpb_ExtMode_IsMessageSet_ITEM:
-        switch (field_number) {
-          case _UPB_MSGSET_TYPEID: {
-            static upb_MiniTable_Field type_id = {
-                0, 0, 0, 0, TYPE_MSGSET_TYPE_ID, 0};
-            return &type_id;
-          }
-          case _UPB_MSGSET_MESSAGE:
-            if (l->fields) {
-              // We saw type_id previously and succeeded in looking up msg.
-              return l->fields;
-            } else {
-              // TODO: out of order MessageSet.
-              // This is a very rare case: all serializers will emit in-order
-              // MessageSets.  To hit this case there has to be some kind of
-              // re-ordering proxy.  We should eventually handle this case, but
-              // not today.
-            }
-            break;
-        }
     }
   }
 
@@ -867,14 +974,9 @@ static const char* decode_wireval(upb_Decoder* d, const char* ptr,
       return ptr + 8;
     case kUpb_WireType_Delimited: {
       int ndx = field->descriptortype;
-      uint64_t size;
       if (upb_FieldMode_Get(field) == kUpb_FieldMode_Array) ndx += TYPE_COUNT;
-      ptr = decode_varint64(d, ptr, &size);
-      if (size >= INT32_MAX || ptr - d->end + (int32_t)size > d->limit) {
-        break; /* Length overflow. */
-      }
+      ptr = upb_Decoder_DecodeSize(d, ptr, &val->size);
       *op = delim_ops[ndx];
-      val->size = size;
       return ptr;
     }
     case kUpb_WireType_StartGroup:
@@ -905,7 +1007,7 @@ static const char* decode_known(upb_Decoder* d, const char* ptr,
     const upb_MiniTable_Extension* ext_layout =
         (const upb_MiniTable_Extension*)field;
     upb_Message_Extension* ext =
-        _upb_Message_Getorcreateext(msg, ext_layout, &d->arena);
+        _upb_Message_GetOrCreateExtension(msg, ext_layout, &d->arena);
     if (UPB_UNLIKELY(!ext)) return decode_err(d, kUpb_DecodeStatus_OutOfMemory);
     msg = &ext->data;
     subs = &ext->ext->sub;
@@ -1038,14 +1140,8 @@ static const char* decode_msg(upb_Decoder* d, const char* ptr, upb_Message* msg,
           ptr = decode_unknown(d, ptr, msg, field_number, wire_type, val);
           break;
         case OP_MSGSET_ITEM:
-          ptr = decode_msgset(d, ptr, msg, layout);
-          break;
-        case OP_MSGSET_TYPEID: {
-          const upb_MiniTable_Extension* ext = _upb_extreg_get(
-              d->extreg, layout->subs[0].submsg, val.uint64_val);
-          if (ext) ((upb_MiniTable*)layout)->fields = &ext->field;
+          ptr = upb_Decoder_DecodeMessageSetItem(d, ptr, msg, layout);
           break;
-        }
       }
     }
   }

data/third_party/upb/upb/decode.h

@@ -32,6 +32,7 @@
 #ifndef UPB_DECODE_H_
 #define UPB_DECODE_H_
 
+#include "upb/extension_registry.h"
 #include "upb/msg.h"
 
 /* Must be last. */

data/third_party/upb/upb/decode_fast.c

@@ -37,7 +37,7 @@
 
 #include "upb/decode_fast.h"
 
-#include "upb/decode_internal.h"
+#include "upb/internal/decode.h"
 
 /* Must be last. */
 #include "upb/port_def.inc"

data/third_party/upb/upb/def.c

@@ -34,6 +34,7 @@
 #include <string.h>
 
 #include "google/protobuf/descriptor.upb.h"
+#include "upb/mini_table.h"
 #include "upb/reflection.h"
 
 /* Must be last. */
@@ -648,6 +649,14 @@ bool upb_FieldDef_IsString(const upb_FieldDef* f) {
          upb_FieldDef_CType(f) == kUpb_CType_Bytes;
 }
 
+bool upb_FieldDef_IsOptional(const upb_FieldDef* f) {
+  return upb_FieldDef_Label(f) == kUpb_Label_Optional;
+}
+
+bool upb_FieldDef_IsRequired(const upb_FieldDef* f) {
+  return upb_FieldDef_Label(f) == kUpb_Label_Required;
+}
+
 bool upb_FieldDef_IsRepeated(const upb_FieldDef* f) {
   return upb_FieldDef_Label(f) == kUpb_Label_Repeated;
 }
@@ -2338,8 +2347,7 @@ static void create_fielddef(
   }
 
   if (google_protobuf_FieldDescriptorProto_has_oneof_index(field_proto)) {
-    int oneof_index =
-        google_protobuf_FieldDescriptorProto_oneof_index(field_proto);
+    uint32_t oneof_index = google_protobuf_FieldDescriptorProto_oneof_index(field_proto);
     upb_OneofDef* oneof;
     upb_value v = upb_value_constptr(f);
 

data/third_party/upb/upb/def.h

@@ -29,7 +29,7 @@
 #define UPB_DEF_H_
 
 #include "google/protobuf/descriptor.upb.h"
-#include "upb/table_internal.h"
+#include "upb/internal/table.h"
 #include "upb/upb.h"
 
 /* Must be last. */
@@ -116,6 +116,8 @@ const upb_OneofDef* upb_FieldDef_RealContainingOneof(const upb_FieldDef* f);
 uint32_t upb_FieldDef_Index(const upb_FieldDef* f);
 bool upb_FieldDef_IsSubMessage(const upb_FieldDef* f);
 bool upb_FieldDef_IsString(const upb_FieldDef* f);
+bool upb_FieldDef_IsOptional(const upb_FieldDef* f);
+bool upb_FieldDef_IsRequired(const upb_FieldDef* f);
 bool upb_FieldDef_IsRepeated(const upb_FieldDef* f);
 bool upb_FieldDef_IsPrimitive(const upb_FieldDef* f);
 bool upb_FieldDef_IsMap(const upb_FieldDef* f);
@@ -210,6 +212,11 @@ UPB_INLINE bool upb_MessageDef_IsMapEntry(const upb_MessageDef* m) {
   return google_protobuf_MessageOptions_map_entry(upb_MessageDef_Options(m));
 }
 
+UPB_INLINE bool upb_MessageDef_IsMessageSet(const upb_MessageDef* m) {
+  return google_protobuf_MessageOptions_message_set_wire_format(
+      upb_MessageDef_Options(m));
+}
+
 /* Nested entities. */
 int upb_MessageDef_NestedMessageCount(const upb_MessageDef* m);
 int upb_MessageDef_NestedEnumCount(const upb_MessageDef* m);

data/third_party/upb/upb/def.hpp

@@ -373,11 +373,11 @@ class FileDefPtr {
   const upb_FileDef* ptr_;
 };
 
-// Non-const methods in upb::SymbolTable are NOT thread-safe.
-class SymbolTable {
+// Non-const methods in upb::DefPool are NOT thread-safe.
+class DefPool {
  public:
-  SymbolTable() : ptr_(upb_DefPool_New(), upb_DefPool_Free) {}
-  explicit SymbolTable(upb_DefPool* s) : ptr_(s, upb_DefPool_Free) {}
+  DefPool() : ptr_(upb_DefPool_New(), upb_DefPool_Free) {}
+  explicit DefPool(upb_DefPool* s) : ptr_(s, upb_DefPool_Free) {}
 
   const upb_DefPool* ptr() const { return ptr_.get(); }
   upb_DefPool* ptr() { return ptr_.get(); }
@@ -409,6 +409,9 @@ class SymbolTable {
   std::unique_ptr<upb_DefPool, decltype(&upb_DefPool_Free)> ptr_;
 };
 
+// TODO(b/236632406): This typedef is deprecated. Delete it.
+using SymbolTable = DefPool;
+
 inline FileDefPtr MessageDefPtr::file() const {
   return FileDefPtr(upb_MessageDef_File(ptr_));
 }

data/third_party/upb/upb/encode.c

@@ -32,6 +32,7 @@
 #include <setjmp.h>
 #include <string.h>
 
+#include "upb/extension_registry.h"
 #include "upb/msg_internal.h"
 #include "upb/upb.h"
 
@@ -76,7 +77,9 @@ static size_t upb_roundup_pow2(size_t bytes) {
   return ret;
 }
 
-UPB_NORETURN static void encode_err(upb_encstate* e) { UPB_LONGJMP(e->err, 1); }
+UPB_NORETURN static void encode_err(upb_encstate* e, upb_EncodeStatus s) {
+  UPB_LONGJMP(e->err, s);
+}
 
 UPB_NOINLINE
 static void encode_growbuffer(upb_encstate* e, size_t bytes) {
@@ -84,7 +87,7 @@ static void encode_growbuffer(upb_encstate* e, size_t bytes) {
   size_t new_size = upb_roundup_pow2(bytes + (e->limit - e->ptr));
   char* new_buf = upb_realloc(e->alloc, e->buf, old_size, new_size);
 
-  if (!new_buf) encode_err(e);
+  if (!new_buf) encode_err(e, kUpb_EncodeStatus_OutOfMemory);
 
   /* We want previous data at the end, realloc() put it at the beginning. */
   if (old_size > 0) {
@@ -255,7 +258,7 @@ static void encode_scalar(upb_encstate* e, const void* _field_mem,
       if (submsg == NULL) {
         return;
       }
-      if (--e->depth == 0) encode_err(e);
+      if (--e->depth == 0) encode_err(e, kUpb_EncodeStatus_MaxDepthExceeded);
       encode_tag(e, f->number, kUpb_WireType_EndGroup);
       encode_message(e, submsg, subm, &size);
       wire_type = kUpb_WireType_StartGroup;
@@ -269,7 +272,7 @@ static void encode_scalar(upb_encstate* e, const void* _field_mem,
       if (submsg == NULL) {
         return;
       }
-      if (--e->depth == 0) encode_err(e);
+      if (--e->depth == 0) encode_err(e, kUpb_EncodeStatus_MaxDepthExceeded);
       encode_message(e, submsg, subm, &size);
       encode_varint(e, size);
       wire_type = kUpb_WireType_Delimited;
@@ -355,7 +358,7 @@ static void encode_array(upb_encstate* e, const upb_Message* msg,
       const void* const* start = _upb_array_constptr(arr);
       const void* const* ptr = start + arr->len;
       const upb_MiniTable* subm = subs[f->submsg_index].submsg;
-      if (--e->depth == 0) encode_err(e);
+      if (--e->depth == 0) encode_err(e, kUpb_EncodeStatus_MaxDepthExceeded);
       do {
         size_t size;
         ptr--;
@@ -370,7 +373,7 @@ static void encode_array(upb_encstate* e, const upb_Message* msg,
       const void* const* start = _upb_array_constptr(arr);
       const void* const* ptr = start + arr->len;
       const upb_MiniTable* subm = subs[f->submsg_index].submsg;
-      if (--e->depth == 0) encode_err(e);
+      if (--e->depth == 0) encode_err(e, kUpb_EncodeStatus_MaxDepthExceeded);
       do {
         size_t size;
         ptr--;
@@ -413,7 +416,7 @@ static void encode_map(upb_encstate* e, const upb_Message* msg,
 
   if (map == NULL) return;
 
-  if (e->options & kUpb_Encode_Deterministic) {
+  if (e->options & kUpb_EncodeOption_Deterministic) {
     _upb_sortedmap sorted;
     _upb_mapsorter_pushmap(&e->sorter, layout->fields[0].descriptortype, map,
                            &sorted);
@@ -520,16 +523,16 @@ static void encode_message(upb_encstate* e, const upb_Message* msg,
                            const upb_MiniTable* m, size_t* size) {
   size_t pre_len = e->limit - e->ptr;
 
-  if ((e->options & kUpb_Encode_CheckRequired) && m->required_count) {
+  if ((e->options & kUpb_EncodeOption_CheckRequired) && m->required_count) {
     uint64_t msg_head;
     memcpy(&msg_head, msg, 8);
     msg_head = _upb_BigEndian_Swap64(msg_head);
     if (upb_MiniTable_requiredmask(m) & ~msg_head) {
-      encode_err(e);
+      encode_err(e, kUpb_EncodeStatus_MissingRequired);
     }
   }
 
-  if ((e->options & kUpb_Encode_SkipUnknown) == 0) {
+  if ((e->options & kUpb_EncodeOption_SkipUnknown) == 0) {
     size_t unknown_size;
     const char* unknown = upb_Message_GetUnknown(msg, &unknown_size);
 
@@ -570,8 +573,9 @@ static void encode_message(upb_encstate* e, const upb_Message* msg,
   *size = (e->limit - e->ptr) - pre_len;
 }
 
-char* upb_Encode(const void* msg, const upb_MiniTable* l, int options,
-                 upb_Arena* arena, size_t* size) {
+upb_EncodeStatus upb_Encode(const void* msg, const upb_MiniTable* l,
+                            int options, upb_Arena* arena, char** buf,
+                            size_t* size) {
   upb_encstate e;
   unsigned depth = (unsigned)options >> 16;
 
@@ -582,23 +586,28 @@ char* upb_Encode(const void* msg, const upb_MiniTable* l, int options,
   e.depth = depth ? depth : 64;
   e.options = options;
   _upb_mapsorter_init(&e.sorter);
-  char* ret = NULL;
 
-  if (UPB_SETJMP(e.err)) {
-    *size = 0;
-    ret = NULL;
-  } else {
+  upb_EncodeStatus status = UPB_SETJMP(e.err);
+
+  // Unfortunately we must continue to perform hackery here because there are
+  // code paths which blindly copy the returned pointer without bothering to
+  // check for errors until much later (b/235839510). So we still set *buf to
+  // NULL on error and we still set it to non-NULL on a successful empty result.
+  if (status == kUpb_EncodeStatus_Ok) {
     encode_message(&e, msg, l, size);
     *size = e.limit - e.ptr;
     if (*size == 0) {
       static char ch;
-      ret = &ch;
+      *buf = &ch;
     } else {
       UPB_ASSERT(e.ptr);
-      ret = e.ptr;
+      *buf = e.ptr;
     }
+  } else {
+    *buf = NULL;
+    *size = 0;
   }
 
   _upb_mapsorter_destroy(&e.sorter);
-  return ret;
+  return status;
 }

data/third_party/upb/upb/encode.h

@@ -26,7 +26,7 @@
  */
 
 /*
- * upb_Encode: parsing into a upb_Message using a upb_MiniTable.
+ * upb_Encode: parsing from a upb_Message using a upb_MiniTable.
  */
 
 #ifndef UPB_ENCODE_H_
@@ -48,19 +48,29 @@ enum {
    *
    * If your proto contains maps, the encoder will need to malloc()/free()
    * memory during encode. */
-  kUpb_Encode_Deterministic = 1,
+  kUpb_EncodeOption_Deterministic = 1,
 
   /* When set, unknown fields are not printed. */
-  kUpb_Encode_SkipUnknown = 2,
+  kUpb_EncodeOption_SkipUnknown = 2,
 
   /* When set, the encode will fail if any required fields are missing. */
-  kUpb_Encode_CheckRequired = 4,
+  kUpb_EncodeOption_CheckRequired = 4,
 };
 
 #define UPB_ENCODE_MAXDEPTH(depth) ((depth) << 16)
 
-char* upb_Encode(const void* msg, const upb_MiniTable* l, int options,
-                 upb_Arena* arena, size_t* size);
+typedef enum {
+  kUpb_EncodeStatus_Ok = 0,
+  kUpb_EncodeStatus_OutOfMemory = 1,       // Arena alloc failed
+  kUpb_EncodeStatus_MaxDepthExceeded = 2,  // Exceeded UPB_ENCODE_MAXDEPTH
+
+  // kUpb_EncodeOption_CheckRequired failed but the parse otherwise succeeded.
+  kUpb_EncodeStatus_MissingRequired = 3,
+} upb_EncodeStatus;
+
+upb_EncodeStatus upb_Encode(const void* msg, const upb_MiniTable* l,
+                            int options, upb_Arena* arena, char** buf,
+                            size_t* size);
 
 #include "upb/port_undef.inc"