KRPC-564: Reject >10-byte varint tags in protobuf parser

native-deps/shims/protobuf/src/cpp/protowire.cpp

@@ -235,17 +235,18 @@ extern "C" {
     }
 
     int pw_decoder_read_validated_tag(pw_decoder_t *self, uint32_t *tag_out) {
+        // Check for end-of-stream BEFORE attempting to read. ReadVarint64's
+        // fast-path array reader (ReadVarint64FromArray) does not advance the
+        // internal buffer pointer on failure (e.g., >10-byte varints), making
+        // post-failure ConsumedEntireMessage() unreliable.
+        if (self->codedInputStream.ConsumedEntireMessage()) {
+            return 0; // legitimate end of stream
+        }
+
         int pos_before = self->codedInputStream.CurrentPosition();
 
         uint64_t raw64;
         if (!self->codedInputStream.ReadVarint64(&raw64)) {
-            // Use ConsumedEntireMessage() to distinguish
-            // legitimate end-of-stream from actual errors (like >10-byte varints).
-            // Note: CurrentPosition() alone is insufficient because ReadVarint64's
-            // fast-path array reader does not advance the buffer pointer on failure.
-            if (self->codedInputStream.ConsumedEntireMessage()) {
-                return 0; // legitimate end of stream
-            }
             return -1; // error (>10-byte varint, truncated varint, etc.)
         }
 

protobuf/protobuf-api/src/jvmMain/kotlin/kotlinx/rpc/protobuf/internal/WireDecoder.jvm.kt

@@ -24,7 +24,13 @@ internal class WireDecoderJvm(source: Source) : WireDecoder {
         if (codedInputStream.isAtEnd) return null
 
         val posBefore = codedInputStream.totalBytesRead
-        val raw64 = codedInputStream.readRawVarint64()
+        val raw64 = try {
+            codedInputStream.readRawVarint64()
+        } catch (e: InvalidProtocolBufferException) {
+            // readRawVarint64() throws for varints exceeding 10 bytes.
+            // Convert to ProtobufDecodingException so callers only need to handle one type.
+            throw ProtobufDecodingException(e.message ?: "Malformed varint", e)
+        }
         val bytesUsed = codedInputStream.totalBytesRead - posBefore
 
         // A valid tag must fit in 32 bits (29-bit field number + 3-bit wire type).

tests/protobuf-conformance/src/jvmTest/resources/native_known_failures.txt

@@ -2,9 +2,3 @@
 # Tests listed here are excluded from native conformance JUnit assertions.
 # Each line is a test name (text after '#' is a comment).
 
-# >10-byte varint tag rejection not yet handled by C++ ReadVarint64 (pre-existing, also fails on JVM)
-Required.Proto2.ProtobufInput.BadTag_VarintMoreThanTenBytes
-Required.Proto3.ProtobufInput.BadTag_VarintMoreThanTenBytes
-Required.Editions_Proto2.ProtobufInput.BadTag_VarintMoreThanTenBytes
-Required.Editions_Proto3.ProtobufInput.BadTag_VarintMoreThanTenBytes
-

versions-root/libs.versions.toml

@@ -11,7 +11,7 @@ kotlin-compiler = "0.0.0" # default to kotlin-lang or env.KOTLIN_COMPILER_VERSIO
 # the version scheme is "<upstream-grpc-version>-<shim-version>"
 internal-native-grpc-shim = "1.74.1-2"
 # the version scheme is "<upstream-protobuf-version>-<shim-version>"
-internal-native-protobuf-shim = "31.1-2"
+internal-native-protobuf-shim = "31.1-3"
 # the version numbers for the shim annotation
 internal-native-shim-annotation = "0.1.0"