Import of the watch repository from Pebble

third_party/nanopb/tests/regression/GHSA-gcx3-7m76-287p/SConscript

@@ -0,0 +1,13 @@
+# Regression test for security issue GHSA-gcx3-7m76-287p
+# "Out-of-memory condition on repeated field can result in invalid free()"
+
+Import("malloc_env")
+
+malloc_env.NanopbProto("test")
+
+test = malloc_env.Program(["test.c", "test.pb.c",
+                          "$COMMON/pb_decode_with_malloc.o",
+                          "$COMMON/pb_common_with_malloc.o",
+                          "$COMMON/malloc_wrappers.o"])
+                          
+malloc_env.RunTest([test, 'test_input.pb'])

third_party/nanopb/tests/regression/GHSA-gcx3-7m76-287p/test.c

@@ -0,0 +1,39 @@
+#include <pb_decode.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "test_helpers.h"
+#include "test.pb.h"
+
+bool stream_callback(pb_istream_t *stream, uint8_t *buf, size_t count)
+{
+    FILE *file = (FILE*)stream->state;
+    size_t len = fread(buf, 1, count, file);
+    
+    if (len == count)
+    {
+        return true;
+    }
+    else
+    {
+        stream->bytes_left = 0;
+        return false;
+    }
+}
+
+int main()
+{
+    pb_istream_t stream = {&stream_callback, NULL, SIZE_MAX};
+    MyMessage msg = MyMessage_init_default;
+    bool status;
+    stream.state = stdin;
+    SET_BINARY_MODE(stdin);
+
+    set_max_alloc_bytes(512);
+
+    status = pb_decode(&stream, MyMessage_fields, &msg);
+    assert(!status);
+    assert(strcmp(stream.errmsg, "realloc failed") == 0);
+    return 0;
+}
+

third_party/nanopb/tests/regression/GHSA-gcx3-7m76-287p/test.proto

@@ -0,0 +1,7 @@
+syntax = "proto2";
+import "nanopb.proto";
+
+message MyMessage {
+    repeated string values = 1 [(nanopb).type = FT_POINTER];
+}
+