Fixed a fuzz bug when a negative oneof_index is provided.

PiperOrigin-RevId: 647789835

upb/reflection/field_def.c

@@ -648,7 +648,7 @@ static void _upb_FieldDef_Create(upb_DefBuilder* ctx, const char* prefix,
                            f->full_name);
     }
 
-    if (oneof_index >= upb_MessageDef_OneofCount(m)) {
+    if (oneof_index < 0 || oneof_index >= upb_MessageDef_OneofCount(m)) {
       _upb_DefBuilder_Errf(ctx, "oneof_index out of range (%s)", f->full_name);
     }
 

upb/util/def_to_proto_test.cc

@@ -333,4 +333,15 @@ TEST(FuzzTest, RoundTripDescriptorRegressionOneofSameName) {
            })pb"));
 }
 
+TEST(FuzzTest, NegativeOneofIndex) {
+  RoundTripDescriptor(ParseTextProtoOrDie(
+      R"pb(file {
+             message_type {
+               name: "A"
+               field { name: "A" number: 0 type_name: "" oneof_index: -1 }
+             }
+           }
+      )pb"));
+}
+
 }  // namespace upb_test