Added a check to verify that the number of required fields does not exceed the maximum.

upb has an implementation-specific maximum of 63 required fields per message.  We need to verify this limit when building a MiniTable.

PiperOrigin-RevId: 546929196

upb/message/test.cc

@@ -669,4 +669,14 @@ TEST(MessageTest, MapField) {
 //   DecodeEncodeArbitrarySchemaAndPayload({{"%  ^!"}, {}, "", {}}, "", 0, 0);
 // }
 //
+// TEST(FuzzTest, TooManyRequiredFields) {
+//   DecodeEncodeArbitrarySchemaAndPayload(
+//       {{"$ N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N "
+//         "N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N"},
+//        {},
+//        "",
+//        {}},
+//       "", 0, 4);
+// }
+//
 // end:google_only

upb/mini_descriptor/decode.c

@@ -531,7 +531,8 @@ static size_t upb_MiniTable_DivideRoundUp(size_t n, size_t d) {
   return (n + d - 1) / d;
 }
 
-static void upb_MtDecoder_AssignHasbits(upb_MiniTable* ret) {
+static void upb_MtDecoder_AssignHasbits(upb_MtDecoder* d) {
+  upb_MiniTable* ret = d->table;
   int n = ret->field_count;
   int last_hasbit = 0;  // 0 cannot be used.
 
@@ -546,6 +547,10 @@ static void upb_MtDecoder_AssignHasbits(upb_MiniTable* ret) {
   }
   ret->required_count = last_hasbit;
 
+  if (ret->required_count > 63) {
+    upb_MdDecoder_ErrorJmp(&d->base, "Too many required fields");
+  }
+
   // Next assign non-required hasbit fields.
   for (int i = 0; i < n; i++) {
     upb_MiniTableField* field = (upb_MiniTableField*)&ret->fields[i];
@@ -653,7 +658,7 @@ static void upb_MtDecoder_ValidateEntryField(upb_MtDecoder* d,
 static void upb_MtDecoder_ParseMap(upb_MtDecoder* d, const char* data,
                                    size_t len) {
   upb_MtDecoder_ParseMessage(d, data, len);
-  upb_MtDecoder_AssignHasbits(d->table);
+  upb_MtDecoder_AssignHasbits(d);
 
   if (UPB_UNLIKELY(d->table->field_count != 2)) {
     upb_MdDecoder_ErrorJmp(&d->base, "%hu fields in map",
@@ -723,7 +728,7 @@ static upb_MiniTable* upb_MtDecoder_DoBuildMiniTableWithBuf(
 
     case kUpb_EncodedVersion_MessageV1:
       upb_MtDecoder_ParseMessage(decoder, data, len);
-      upb_MtDecoder_AssignHasbits(decoder->table);
+      upb_MtDecoder_AssignHasbits(decoder);
       upb_MtDecoder_SortLayoutItems(decoder);
       upb_MtDecoder_AssignOffsets(decoder);
       break;