grpc 1.81.1 → 1.83.1

data/third_party/upb/upb/wire/internal/decoder.h

@@ -18,9 +18,15 @@
 #include <stdint.h>
 #include <string.h>
 
+#include "upb/base/descriptor_constants.h"
+#include "upb/base/error_handler.h"
+#include "upb/base/string_view.h"
 #include "upb/mem/arena.h"
 #include "upb/mem/internal/arena.h"
+#include "upb/message/message.h"
 #include "upb/mini_table/extension_registry.h"
+#include "upb/mini_table/field.h"
+#include "upb/mini_table/internal/field.h"
 #include "upb/mini_table/internal/message.h"
 #include "upb/mini_table/message.h"
 #include "upb/wire/decode.h"
@@ -43,14 +49,12 @@ typedef struct upb_Decoder {
   bool message_is_done;
   union {
     upb_Arena arena;
-    void* foo[UPB_ARENA_SIZE_HACK];
+    void* foo[UPB_ARENA_SIZE_HACK / sizeof(void*)];
   };
-  upb_DecodeStatus status;
-  jmp_buf err;
+  upb_ErrorHandler err;
 
 #ifndef NDEBUG
-  const char* debug_tagstart;
-  const char* debug_valstart;
+  char* trace_buf;
   char* trace_ptr;
   char* trace_end;
 #endif
@@ -61,17 +65,31 @@ UPB_INLINE const char* upb_Decoder_Init(upb_Decoder* d, const char* buf,
                                         const upb_ExtensionRegistry* extreg,
                                         int options, upb_Arena* arena,
                                         char* trace_buf, size_t trace_size) {
-  upb_EpsCopyInputStream_Init(&d->input, &buf, size,
-                              options & kUpb_DecodeOption_AliasString);
+  upb_ErrorHandler_Init(&d->err);
+  upb_EpsCopyInputStream_InitWithErrorHandler(&d->input, &buf, size, &d->err);
+
+  UPB_STATIC_ASSERT((int)kUpb_DecodeStatus_Ok == (int)kUpb_ErrorCode_Ok,
+                    "mismatched error codes");
+  UPB_STATIC_ASSERT(
+      (int)kUpb_DecodeStatus_OutOfMemory == (int)kUpb_ErrorCode_OutOfMemory,
+      "mismatched error codes");
+  UPB_STATIC_ASSERT(
+      (int)kUpb_DecodeStatus_Malformed == (int)kUpb_ErrorCode_Malformed,
+      "mismatched error codes");
+
+  if (options & kUpb_DecodeOption_AlwaysValidateUtf8) {
+    // Fasttable decoder does not support this option.
+    options |= kUpb_DecodeOption_DisableFastTable;
+  }
 
   d->extreg = extreg;
   d->depth = upb_DecodeOptions_GetEffectiveMaxDepth(options);
   d->end_group = DECODE_NOGROUP;
   d->options = (uint16_t)options;
   d->missing_required = false;
-  d->status = kUpb_DecodeStatus_Ok;
   d->message_is_done = false;
 #ifndef NDEBUG
+  d->trace_buf = trace_buf;
   d->trace_ptr = trace_buf;
   d->trace_end = UPB_PTRADD(trace_buf, trace_size);
 #endif
@@ -89,7 +107,33 @@ UPB_INLINE const char* upb_Decoder_Init(upb_Decoder* d, const char* buf,
 UPB_INLINE upb_DecodeStatus upb_Decoder_Destroy(upb_Decoder* d,
                                                 upb_Arena* arena) {
   UPB_PRIVATE(_upb_Arena_SwapOut)(arena, &d->arena);
-  return d->status;
+  return (upb_DecodeStatus)d->err.code;
+}
+
+#ifndef NDEBUG
+UPB_INLINE bool _upb_Decoder_TraceBufferFull(upb_Decoder* d) {
+  return d->trace_ptr == d->trace_end - 1;
+}
+
+UPB_INLINE bool _upb_Decoder_TraceBufferAlmostFull(upb_Decoder* d) {
+  return d->trace_ptr == d->trace_end - 2;
+}
+#endif
+
+UPB_INLINE char* _upb_Decoder_TraceNext(upb_Decoder* d) {
+#ifndef NDEBUG
+  return _upb_Decoder_TraceBufferAlmostFull(d) ? NULL : d->trace_ptr + 1;
+#else
+  return NULL;
+#endif
+}
+
+UPB_INLINE char* _upb_Decoder_TracePtr(upb_Decoder* d) {
+#ifndef NDEBUG
+  return d->trace_ptr;
+#else
+  return NULL;
+#endif
 }
 
 // Trace events are used to trace the progress of the decoder.
@@ -102,7 +146,7 @@ UPB_INLINE upb_DecodeStatus upb_Decoder_Destroy(upb_Decoder* d,
 UPB_INLINE void _upb_Decoder_Trace(upb_Decoder* d, char event) {
 #ifndef NDEBUG
   if (d->trace_ptr == NULL) return;
-  if (d->trace_ptr == d->trace_end - 1) {
+  if (_upb_Decoder_TraceBufferFull(d)) {
     d->trace_ptr[-1] = 'X';  // Truncated.
     return;
   }
@@ -131,26 +175,42 @@ UPB_INLINE const upb_MiniTable* decode_totablep(intptr_t table) {
   return (const upb_MiniTable*)(table >> 8);
 }
 
-const char* _upb_Decoder_IsDoneFallback(upb_EpsCopyInputStream* e,
-                                        const char* ptr, int overrun);
-
 const char* _upb_Decoder_DecodeMessage(upb_Decoder* d, const char* ptr,
                                        upb_Message* msg,
                                        const upb_MiniTable* layout);
 
-UPB_INLINE bool _upb_Decoder_IsDone(upb_Decoder* d, const char** ptr) {
-  return upb_EpsCopyInputStream_IsDoneWithCallback(
-      &d->input, ptr, &_upb_Decoder_IsDoneFallback);
-}
+UPB_INLINE bool _upb_Decoder_FieldRequiresUtf8Validation(
+    const upb_Decoder* d, const upb_MiniTableField* field) {
+  if (field->UPB_PRIVATE(descriptortype) == kUpb_FieldType_String) return true;
 
-UPB_NORETURN void* _upb_Decoder_ErrorJmp(upb_Decoder* d,
-                                         upb_DecodeStatus status);
+  if (field->UPB_PRIVATE(descriptortype) == kUpb_FieldType_Bytes &&
+      (field->UPB_ONLYBITS(mode) & kUpb_LabelFlags_IsAlternate) &&
+      (d->options & kUpb_DecodeOption_AlwaysValidateUtf8)) {
+    return true;
+  }
+
+  return false;
+}
 
-UPB_INLINE const char* _upb_Decoder_BufferFlipCallback(
-    upb_EpsCopyInputStream* e, const char* old_end, const char* new_start) {
-  upb_Decoder* d = (upb_Decoder*)e;
-  if (!old_end) _upb_Decoder_ErrorJmp(d, kUpb_DecodeStatus_Malformed);
-  return new_start;
+UPB_INLINE bool _upb_Decoder_ReadString(upb_Decoder* d, const char** ptr,
+                                        size_t size, upb_StringView* sv,
+                                        bool validate_utf8) {
+  upb_StringView tmp;
+  *ptr =
+      upb_EpsCopyInputStream_ReadStringAlwaysAlias(&d->input, *ptr, size, &tmp);
+  if (*ptr == NULL) return false;
+  if (validate_utf8 && !utf8_range_IsValid(tmp.data, tmp.size)) {
+    upb_ErrorHandler_ThrowError(&d->err, kUpb_DecodeStatus_BadUtf8);
+    return false;
+  }
+  if ((d->options & kUpb_DecodeOption_AliasString) == 0) {
+    char* data = (char*)upb_Arena_Malloc(&d->arena, tmp.size);
+    if (!data) return false;
+    memcpy(data, tmp.data, tmp.size);
+    tmp.data = data;
+  }
+  *sv = tmp;
+  return true;
 }
 
 #include "upb/port/undef.inc"

data/third_party/upb/upb/wire/internal/eps_copy_input_stream.h

@@ -0,0 +1,339 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2025 Google LLC.  All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+#ifndef UPB_WIRE_INTERNAL_EPS_COPY_INPUT_STREAM_H_
+#define UPB_WIRE_INTERNAL_EPS_COPY_INPUT_STREAM_H_
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "upb/base/error_handler.h"
+#include "upb/base/string_view.h"
+
+// Must be last.
+#include "upb/port/def.inc"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// The maximum number of bytes a single protobuf field can take up in the
+// wire format.  We only want to do one bounds check per field, so the input
+// stream guarantees that after upb_EpsCopyInputStream_IsDone() is called,
+// the decoder can read this many bytes without performing another bounds
+// check.  The stream will copy into a patch buffer as necessary to guarantee
+// this invariant. Since tags can only be up to 5 bytes, and a max-length scalar
+// field can be 10 bytes, only 15 is required; but sizing up to 16 permits more
+// efficient fixed size copies.
+#define kUpb_EpsCopyInputStream_SlopBytes 16
+
+struct upb_EpsCopyInputStream {
+  const char* end;        // Can read up to SlopBytes bytes beyond this.
+  const char* limit_ptr;  // For bounds checks, = end + UPB_MIN(limit, 0)
+  uintptr_t input_delta;  // Diff between the original input pointer and patch
+  const char* buffer_start;   // Pointer to the original input buffer
+  const char* capture_start;  // If non-NULL, the start of the captured region.
+  ptrdiff_t limit;            // Submessage limit relative to end
+  upb_ErrorHandler* err;      // Error handler to use when things go wrong.
+  bool error;                 // To distinguish between EOF and error.
+#ifndef NDEBUG
+  int guaranteed_bytes;
+#endif
+  // Allocate double the size of what's required; this permits a fixed-size copy
+  // from the input buffer, regardless of how many bytes actually remain in the
+  // input buffer.
+  char patch[kUpb_EpsCopyInputStream_SlopBytes * 2];
+};
+
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(
+    struct upb_EpsCopyInputStream* e);
+
+UPB_INLINE bool upb_EpsCopyInputStream_IsError(
+    struct upb_EpsCopyInputStream* e) {
+  return e->error;
+}
+
+UPB_INLINE void upb_EpsCopyInputStream_InitWithErrorHandler(
+    struct upb_EpsCopyInputStream* e, const char** ptr, size_t size,
+    upb_ErrorHandler* err) {
+  e->buffer_start = *ptr;
+  e->capture_start = NULL;
+  e->err = err;
+  if (size <= kUpb_EpsCopyInputStream_SlopBytes) {
+    memset(&e->patch, 0, 32);
+    if (size) memcpy(&e->patch, *ptr, size);
+    e->input_delta = (uintptr_t)*ptr - (uintptr_t)e->patch;
+    *ptr = e->patch;
+    e->end = *ptr + size;
+    e->limit = 0;
+  } else {
+    e->end = *ptr + size - kUpb_EpsCopyInputStream_SlopBytes;
+    e->limit = kUpb_EpsCopyInputStream_SlopBytes;
+    e->input_delta = 0;
+  }
+  e->limit_ptr = e->end;
+  e->error = false;
+  UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+}
+
+UPB_INLINE void upb_EpsCopyInputStream_Init(struct upb_EpsCopyInputStream* e,
+                                            const char** ptr, size_t size) {
+  upb_EpsCopyInputStream_InitWithErrorHandler(e, ptr, size, NULL);
+}
+
+UPB_ATTR_CONST
+UPB_INLINE bool upb_EpsCopyInputStream_HasErrorHandler(
+    const struct upb_EpsCopyInputStream* e) {
+  return e && e->err != NULL;
+}
+
+// Call this function to signal an error. If an error handler is set, it will be
+// called and the function will never return. Otherwise, returns NULL to
+// indicate an error.
+const char* UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(
+    struct upb_EpsCopyInputStream* e);
+
+UPB_INLINE const char* UPB_PRIVATE(upb_EpsCopyInputStream_AssumeResult)(
+    struct upb_EpsCopyInputStream* e, const char* ptr) {
+  UPB_MAYBE_ASSUME(upb_EpsCopyInputStream_HasErrorHandler(e), ptr != NULL);
+  return ptr;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+// Debug checks that attempt to ensure that no code paths will overrun the slop
+// bytes even in the worst case. Since we are frequently parsing varints, it's
+// possible that the user is trying to parse too many varints before calling
+// upb_EpsCopyInputStream_IsDone(), but this error case is not detected because
+// the varints are short. These checks ensure that will not overrun the slop
+// bytes, even if each varint is its maximum possible length.
+
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(
+    struct upb_EpsCopyInputStream* e) {
+#ifndef NDEBUG
+  e->guaranteed_bytes = kUpb_EpsCopyInputStream_SlopBytes;
+#endif
+}
+
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(
+    struct upb_EpsCopyInputStream* e) {
+#ifndef NDEBUG
+  e->guaranteed_bytes = 0;
+#endif
+}
+
+// Signals the maximum number that the operation about to be performed may
+// consume.
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(
+    struct upb_EpsCopyInputStream* e, int n) {
+#ifndef NDEBUG
+  if (e) {
+    UPB_ASSERT(e->guaranteed_bytes >= n);
+    e->guaranteed_bytes -= n;
+  }
+#endif
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+typedef enum {
+  // The current stream position is at a limit.
+  kUpb_IsDoneStatus_Done,
+
+  // The current stream position is not at a limit.
+  kUpb_IsDoneStatus_NotDone,
+
+  // The current stream position is not at a limit, and the stream needs to
+  // be flipped to a new buffer before more data can be read.
+  kUpb_IsDoneStatus_NeedFallback,
+} upb_IsDoneStatus;
+
+// Returns the status of the current stream position.  This is a low-level
+// function, it is simpler to call upb_EpsCopyInputStream_IsDone() if possible.
+UPB_INLINE upb_IsDoneStatus UPB_PRIVATE(upb_EpsCopyInputStream_IsDoneStatus)(
+    struct upb_EpsCopyInputStream* e, const char* ptr, int* overrun) {
+  *overrun = ptr - e->end;
+  if (UPB_LIKELY(ptr < e->limit_ptr)) {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+    return kUpb_IsDoneStatus_NotDone;
+  } else if (UPB_LIKELY(*overrun == e->limit)) {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
+    return kUpb_IsDoneStatus_Done;
+  } else {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
+    return kUpb_IsDoneStatus_NeedFallback;
+  }
+}
+
+const char* UPB_PRIVATE(upb_EpsCopyInputStream_IsDoneFallback)(
+    struct upb_EpsCopyInputStream* e, const char* ptr, int overrun);
+
+UPB_INLINE bool upb_EpsCopyInputStream_IsDone(struct upb_EpsCopyInputStream* e,
+                                              const char** ptr) {
+  int overrun;
+  switch (UPB_PRIVATE(upb_EpsCopyInputStream_IsDoneStatus)(e, *ptr, &overrun)) {
+    case kUpb_IsDoneStatus_Done:
+      UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
+      return true;
+    case kUpb_IsDoneStatus_NotDone:
+      UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+      return false;
+    case kUpb_IsDoneStatus_NeedFallback:
+      *ptr =
+          UPB_PRIVATE(upb_EpsCopyInputStream_IsDoneFallback)(e, *ptr, overrun);
+      if (*ptr) {
+        UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+      } else {
+        UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
+      }
+      return *ptr == NULL;
+  }
+  UPB_UNREACHABLE();
+}
+
+UPB_INLINE bool upb_EpsCopyInputStream_CheckSize(
+    const struct upb_EpsCopyInputStream* e, const char* ptr, int size) {
+  UPB_ASSERT(size >= 0);
+  return size <= e->limit - (ptr - e->end);
+}
+
+// Returns a pointer into an input buffer that corresponds to the parsing
+// pointer `ptr`.  The returned pointer may be the same as `ptr`, but also may
+// be different if we are currently parsing out of the patch buffer.
+UPB_INLINE const char* UPB_PRIVATE(upb_EpsCopyInputStream_GetInputPtr)(
+    struct upb_EpsCopyInputStream* e, const char* ptr) {
+  // This somewhat silly looking add-and-subtract behavior provides provenance
+  // from the original input buffer's pointer. After optimization it produces
+  // the same assembly as just casting `(uintptr_t)ptr+input_delta`
+  // https://godbolt.org/z/zosG88oPn
+  size_t position =
+      (uintptr_t)ptr + e->input_delta - (uintptr_t)e->buffer_start;
+  return e->buffer_start + position;
+}
+
+UPB_INLINE void upb_EpsCopyInputStream_StartCapture(
+    struct upb_EpsCopyInputStream* e, const char* ptr) {
+  UPB_ASSERT(e->capture_start == NULL);
+  e->capture_start = UPB_PRIVATE(upb_EpsCopyInputStream_GetInputPtr)(e, ptr);
+}
+
+UPB_INLINE bool upb_EpsCopyInputStream_EndCapture(
+    struct upb_EpsCopyInputStream* e, const char* ptr, upb_StringView* sv) {
+  UPB_ASSERT(e->capture_start != NULL);
+  if (ptr - e->end > e->limit) {
+    return UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(e);
+  }
+  const char* end = UPB_PRIVATE(upb_EpsCopyInputStream_GetInputPtr)(e, ptr);
+  sv->data = e->capture_start;
+  sv->size = end - sv->data;
+  e->capture_start = NULL;
+  return true;
+}
+
+UPB_INLINE const char* upb_EpsCopyInputStream_ReadStringAlwaysAlias(
+    struct upb_EpsCopyInputStream* e, const char* ptr, size_t size,
+    upb_StringView* sv) {
+  UPB_ASSERT(size <= PTRDIFF_MAX);
+  // The `size` must be within the input buffer. If `ptr` is in the input
+  // buffer, then using the slop bytes is fine (because they are real bytes from
+  // the tail of the input buffer). If `ptr` is in the patch buffer, then slop
+  // bytes represent bytes that do not actually exist in the original input
+  // buffer, so we must fail if the size extends into the slop bytes.
+  const char* limit =
+      e->end + (e->input_delta == 0) * kUpb_EpsCopyInputStream_SlopBytes;
+  if ((ptrdiff_t)size > limit - ptr) {
+    // For the moment, we consider this an error.  In a multi-buffer world,
+    // it could be that the requested string extends into the next buffer, which
+    // is not an error and should be recoverable.
+    return UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(e);
+  }
+  const char* input = UPB_PRIVATE(upb_EpsCopyInputStream_GetInputPtr)(e, ptr);
+  *sv = upb_StringView_FromDataAndSize(input, size);
+  return ptr + size;
+}
+
+UPB_INLINE const char* upb_EpsCopyInputStream_ReadStringEphemeral(
+    struct upb_EpsCopyInputStream* e, const char* ptr, size_t size,
+    upb_StringView* sv) {
+  UPB_ASSERT(size <= PTRDIFF_MAX);
+  // Size must be within the current buffer (including slop bytes).
+  const char* limit = e->end + kUpb_EpsCopyInputStream_SlopBytes;
+  if ((ptrdiff_t)size > limit - ptr) {
+    // For the moment, we consider this an error.  In a multi-buffer world,
+    // it could be that the requested string extends into the next buffer, which
+    // is not an error and should be recoverable.
+    return UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(e);
+  }
+  *sv = upb_StringView_FromDataAndSize(ptr, size);
+  return ptr + size;
+}
+
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_CheckLimit)(
+    struct upb_EpsCopyInputStream* e) {
+  UPB_ASSERT(e->limit_ptr == e->end + UPB_MIN(0, e->limit));
+}
+
+UPB_INLINE ptrdiff_t upb_EpsCopyInputStream_PushLimit(
+    struct upb_EpsCopyInputStream* e, const char* ptr, size_t size) {
+  UPB_ASSERT(size <= PTRDIFF_MAX);
+  ptrdiff_t limit = (ptrdiff_t)size + (ptr - e->end);
+  ptrdiff_t delta = e->limit - limit;
+  UPB_PRIVATE(upb_EpsCopyInputStream_CheckLimit)(e);
+  e->limit = limit;
+  e->limit_ptr = e->end + UPB_MIN(0, limit);
+  UPB_PRIVATE(upb_EpsCopyInputStream_CheckLimit)(e);
+  if (UPB_UNLIKELY(delta < 0)) {
+    UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(e);
+  }
+  return delta;
+}
+
+// Pops the last limit that was pushed on this stream.  This may only be called
+// once IsDone() returns true.  The user must pass the delta that was returned
+// from PushLimit().
+UPB_INLINE void upb_EpsCopyInputStream_PopLimit(
+    struct upb_EpsCopyInputStream* e, const char* ptr, ptrdiff_t saved_delta) {
+  UPB_ASSERT(ptr - e->end == e->limit);
+  UPB_PRIVATE(upb_EpsCopyInputStream_CheckLimit)(e);
+  e->limit += saved_delta;
+  e->limit_ptr = e->end + UPB_MIN(0, e->limit);
+  UPB_PRIVATE(upb_EpsCopyInputStream_CheckLimit)(e);
+}
+
+typedef const char* upb_EpsCopyInputStream_ParseDelimitedFunc(
+    struct upb_EpsCopyInputStream* e, const char* ptr, int size, void* ctx);
+
+UPB_FORCEINLINE bool upb_EpsCopyInputStream_TryParseDelimitedFast(
+    struct upb_EpsCopyInputStream* e, const char** ptr, size_t size,
+    upb_EpsCopyInputStream_ParseDelimitedFunc* func, void* ctx) {
+  UPB_ASSERT(size <= PTRDIFF_MAX);
+  if ((ptrdiff_t)size > e->limit_ptr - *ptr) {
+    return false;
+  }
+
+  // Fast case: Sub-message is <128 bytes and fits in the current buffer.
+  // This means we can preserve limit/limit_ptr verbatim.
+  const char* saved_limit_ptr = e->limit_ptr;
+  int saved_limit = e->limit;
+  e->limit_ptr = *ptr + size;
+  e->limit = e->limit_ptr - e->end;
+  UPB_ASSERT(e->limit_ptr == e->end + UPB_MIN(0, e->limit));
+  *ptr = func(e, *ptr, size, ctx);
+  e->limit_ptr = saved_limit_ptr;
+  e->limit = saved_limit;
+  UPB_ASSERT(e->limit_ptr == e->end + UPB_MIN(0, e->limit));
+  return true;
+}
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#include "upb/port/undef.inc"
+
+#endif  // UPB_WIRE_INTERNAL_EPS_COPY_INPUT_STREAM_H_

data/third_party/upb/upb/wire/internal/reader.h

@@ -29,11 +29,16 @@ extern "C" {
 #endif
 
 UPB_PRIVATE(_upb_WireReader_LongVarint)
-UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(const char* ptr, uint32_t val);
+UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(const char* ptr, uint64_t val,
+                                            upb_EpsCopyInputStream* stream);
 UPB_PRIVATE(_upb_WireReader_LongVarint)
-UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(const char* ptr, uint64_t val);
+UPB_PRIVATE(_upb_WireReader_ReadLongTag)(const char* ptr, uint64_t val,
+                                         upb_EpsCopyInputStream* stream);
+UPB_PRIVATE(_upb_WireReader_LongVarint)
+UPB_PRIVATE(_upb_WireReader_ReadLongSize)(const char* ptr, uint64_t val,
+                                          upb_EpsCopyInputStream* stream);
 
-UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadVarint)(
+UPB_FORCEINLINE const char* upb_WireReader_ReadVarint(
     const char* ptr, uint64_t* val, upb_EpsCopyInputStream* stream) {
   UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 10);
   uint8_t byte = *ptr;
@@ -41,14 +46,13 @@ UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadVarint)(
     *val = byte;
     return ptr + 1;
   }
-  UPB_PRIVATE(_upb_WireReader_LongVarint)
-  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(ptr, byte);
-  if (UPB_UNLIKELY(!res.ptr)) return NULL;
+  UPB_PRIVATE(_upb_WireReader_LongVarint) res;
+  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(ptr, byte, stream);
   *val = res.val;
-  return res.ptr;
+  return UPB_PRIVATE(upb_EpsCopyInputStream_AssumeResult)(stream, res.ptr);
 }
 
-UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadTag)(
+UPB_FORCEINLINE const char* upb_WireReader_ReadTag(
     const char* ptr, uint32_t* val, upb_EpsCopyInputStream* stream) {
   UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 5);
   uint8_t byte = *ptr;
@@ -56,11 +60,24 @@ UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadTag)(
     *val = byte;
     return ptr + 1;
   }
-  UPB_PRIVATE(_upb_WireReader_LongVarint)
-  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(ptr, byte);
-  if (UPB_UNLIKELY(!res.ptr)) return NULL;
+  UPB_PRIVATE(_upb_WireReader_LongVarint) res;
+  res = UPB_PRIVATE(_upb_WireReader_ReadLongTag)(ptr, byte, stream);
+  *val = res.val;
+  return UPB_PRIVATE(upb_EpsCopyInputStream_AssumeResult)(stream, res.ptr);
+}
+
+UPB_FORCEINLINE const char* upb_WireReader_ReadSize(
+    const char* ptr, int* val, upb_EpsCopyInputStream* stream) {
+  UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 5);
+  uint8_t byte = *ptr;
+  if (UPB_LIKELY((byte & 0x80) == 0)) {
+    *val = byte;
+    return ptr + 1;
+  }
+  UPB_PRIVATE(_upb_WireReader_LongVarint) res;
+  res = UPB_PRIVATE(_upb_WireReader_ReadLongSize)(ptr, byte, stream);
   *val = res.val;
-  return res.ptr;
+  return UPB_PRIVATE(upb_EpsCopyInputStream_AssumeResult)(stream, res.ptr);
 }
 
 UPB_API_INLINE uint32_t upb_WireReader_GetFieldNumber(uint32_t tag) {

data/third_party/upb/upb/wire/reader.c

@@ -17,51 +17,64 @@
 #include "upb/port/def.inc"
 
 UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
-    UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(const char* ptr,
-                                                  uint64_t val) {
-  UPB_PRIVATE(_upb_WireReader_LongVarint) ret = {NULL, 0};
-  uint64_t byte;
+    UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(
+        const char* ptr, uint64_t val, upb_EpsCopyInputStream* stream) {
   for (int i = 1; i < 10; i++) {
-    byte = (uint8_t)ptr[i];
+    uint64_t byte = (uint8_t)ptr[i];
     val += (byte - 1) << (i * 7);
     if (!(byte & 0x80)) {
-      ret.ptr = ptr + i + 1;
-      ret.val = val;
-      return ret;
+      return (UPB_PRIVATE(_upb_WireReader_LongVarint)){ptr + i + 1, val};
     }
   }
-  return ret;
+  return (UPB_PRIVATE(_upb_WireReader_LongVarint)){
+      UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(stream), 0};
 }
 
 UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
-    UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(const char* ptr,
-                                                  uint32_t val) {
-  UPB_PRIVATE(_upb_WireReader_LongVarint) ret = {NULL, 0};
-  uint64_t byte;
+    UPB_PRIVATE(_upb_WireReader_ReadLongTag)(const char* ptr, uint64_t val,
+                                             upb_EpsCopyInputStream* stream) {
   for (int i = 1; i < 5; i++) {
-    byte = (uint8_t)ptr[i];
+    uint64_t byte = (uint8_t)ptr[i];
     val += (byte - 1) << (i * 7);
     if (!(byte & 0x80)) {
-      ret.ptr = ptr + i + 1;
-      ret.val = val;
-      return ret;
+      if (val > UINT32_MAX) break;
+      return (UPB_PRIVATE(_upb_WireReader_LongVarint)){ptr + i + 1, val};
     }
   }
-  return ret;
+  return (UPB_PRIVATE(_upb_WireReader_LongVarint)){
+      UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(stream), 0};
+}
+
+UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
+    UPB_PRIVATE(_upb_WireReader_ReadLongSize)(const char* ptr, uint64_t val,
+                                              upb_EpsCopyInputStream* stream) {
+  for (int i = 1; i < 5; i++) {
+    uint64_t byte = (uint8_t)ptr[i];
+    val += (byte - 1) << (i * 7);
+    if (!(byte & 0x80)) {
+      if (val > INT32_MAX) break;
+      return (UPB_PRIVATE(_upb_WireReader_LongVarint)){ptr + i + 1, val};
+    }
+  }
+  return (UPB_PRIVATE(_upb_WireReader_LongVarint)){
+      UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(stream), 0};
 }
 
 const char* UPB_PRIVATE(_upb_WireReader_SkipGroup)(
     const char* ptr, uint32_t tag, int depth_limit,
     upb_EpsCopyInputStream* stream) {
-  if (--depth_limit == 0) return NULL;
+  if (--depth_limit < 0) {
+    return UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(stream);
+  }
   uint32_t end_group_tag = (tag & ~7ULL) | kUpb_WireType_EndGroup;
   while (!upb_EpsCopyInputStream_IsDone(stream, &ptr)) {
     uint32_t tag;
     ptr = upb_WireReader_ReadTag(ptr, &tag, stream);
-    if (!ptr) return NULL;
+    if (!ptr) break;
     if (tag == end_group_tag) return ptr;
     ptr = _upb_WireReader_SkipValue(ptr, tag, depth_limit, stream);
-    if (!ptr) return NULL;
+    if (!ptr) break;
   }
-  return ptr;
+  // Encountered limit end before end group tag.
+  return UPB_PRIVATE(upb_EpsCopyInputStream_ReturnError)(stream);
 }