commit 37cbbeb5589d7180d7af27ac4948cd1a70654adf
author Damien Neil <dneil@google.com> Mon Feb 24 11:10:10 2020 -0800
committer Damien Neil <dneil@google.com> Mon Feb 24 20:12:47 2020 +0000
tree 711528e35158b00afe276c15b20927f31febb183
parent a88c3c4068d554c4a60c5f75c873d1069a14b496

internal/impl: check for size cache overflow

The size cache is an int32. Store a -1 in it if the message size
overflows, and fall back to recomputing the size if the value is
negative. This means lamentable O(N^2) costs in marshaling,
but that's better than silently producing invalid output.

Also considered: Return an error. Avoids O(N^2) behavior, but gives the
user no good choices if they don't care the output being slow. Encoding
costs of messages this large are likely to be dominated by copying the
bytes rather than the size operation anyway, so slow-but-correct seems
like the most generally useful option.

We could store valid values for the range (0x7fffffff,0xfffffffe)
reserving only 0xffffffff as the overflow sentinel, but optimizing this
case seems less important than the code being obviously correct.

Fixes golang/protobuf#970.

Change-Id: I44f59ff81fdfbc8672dd5aec959d5153a081aab9
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/220593
Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>