From 3995f538ed5a0bfa04bfa88a6a03c6d8e99dce46 Mon Sep 17 00:00:00 2001
From: Adam Cozzette <acozzette@google.com>
Date: Mon, 5 Feb 2024 12:06:37 -0800
Subject: [PATCH] Fix crash found by fuzzer in descriptor.cc

PiperOrigin-RevId: 604391963
---
 src/google/protobuf/descriptor.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/google/protobuf/descriptor.cc b/src/google/protobuf/descriptor.cc
index 4d7ce3df89..87bccd031e 100644
--- a/src/google/protobuf/descriptor.cc
+++ b/src/google/protobuf/descriptor.cc
@@ -6054,6 +6054,10 @@ void DescriptorBuilder::BuildMessage(const DescriptorProto& proto,
   BUILD_ARRAY(proto, result, extension, BuildExtension, result);
   BUILD_ARRAY(proto, result, reserved_range, BuildReservedRange, result);
 
+  // Copy options.
+  AllocateOptions(proto, result, DescriptorProto::kOptionsFieldNumber,
+                  "google.protobuf.MessageOptions", alloc);
+
   // Before building submessages, check recursion limit.
   --recursion_depth_;
   IncrementWhenDestroyed revert{recursion_depth_};
@@ -6075,10 +6079,6 @@ void DescriptorBuilder::BuildMessage(const DescriptorProto& proto,
     result->reserved_names_[i] = alloc.AllocateStrings(proto.reserved_name(i));
   }
 
-  // Copy options.
-  AllocateOptions(proto, result, DescriptorProto::kOptionsFieldNumber,
-                  "google.protobuf.MessageOptions", alloc);
-
   AddSymbol(result->full_name(), parent, result->name(), proto, Symbol(result));
 
   for (int i = 0; i < proto.reserved_range_size(); i++) {