From 7193a1812115a34b859ce8e6e46cf3b88fa0c74c Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Wed, 3 Jun 2026 11:28:48 -0400 Subject: [PATCH 01/18] Fix: Check flatbuffer integrity before parsing Updated flatbuffer to latest version to get verify buffer Use strol for key parsing to ensure exceptions do not result in a crash. --- cmake/external/flatbuffers.cmake | 6 ++-- remote_config/src/desktop/config_data.cc | 6 ++++ remote_config/src/desktop/file_manager.cc | 24 +++++++++++--- remote_config/src/desktop/metadata.cc | 19 ++++++++++- .../flatbuffers/0001-remove-unused-var.patch | 32 ------------------- 5 files changed, 46 insertions(+), 41 deletions(-) delete mode 100644 scripts/git/patches/flatbuffers/0001-remove-unused-var.patch diff --git a/cmake/external/flatbuffers.cmake b/cmake/external/flatbuffers.cmake index aea3abb201..c79d686db4 100644 --- a/cmake/external/flatbuffers.cmake +++ b/cmake/external/flatbuffers.cmake @@ -18,9 +18,8 @@ if(TARGET flatbuffers OR NOT DOWNLOAD_FLATBUFFERS) return() endif() -set(version 99aa1ef21dd9dc3f9d4fb0eb82f4b59d0bb5e4c5) -set(patch_file - ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-remove-unused-var.patch) +# Commit corresponds to Tag v25.12.19-2026-02-06-03fffb2 +set(version 95fda8c23e6e30ebd975892b5fad01efa53e039c) ExternalProject_Add( flatbuffers @@ -29,7 +28,6 @@ ExternalProject_Add( COMMAND git init flatbuffers COMMAND cd flatbuffers && git fetch --depth=1 https://github.com/google/flatbuffers.git ${version} && git reset --hard FETCH_HEAD - PATCH_COMMAND git apply ${patch_file} && git gc --aggressive PREFIX ${PROJECT_BINARY_DIR} CONFIGURE_COMMAND "" diff --git a/remote_config/src/desktop/config_data.cc b/remote_config/src/desktop/config_data.cc index a676f9a40a..7d0fdbb14d 100644 --- a/remote_config/src/desktop/config_data.cc +++ b/remote_config/src/desktop/config_data.cc @@ -51,6 +51,9 @@ std::string NamespacedConfigData::Serialize() const { void NamespacedConfigData::Deserialize(const std::string& buffer) { const uint8_t* data = reinterpret_cast(buffer.data()); size_t size = buffer.size(); + if (!flexbuffers::VerifyBuffer(data, size)) { + return; + } auto struct_map = flexbuffers::GetRoot(data, size).AsMap(); flexbuffers::Map ns_config_map = struct_map["config_"].AsMap(); for (int i = 0, in = ns_config_map.size(); i < in; ++i) { @@ -144,6 +147,9 @@ std::string LayeredConfigs::Serialize() const { void LayeredConfigs::Deserialize(const std::string& buffer) { const uint8_t* data = reinterpret_cast(buffer.data()); size_t size = buffer.size(); + if (!flexbuffers::VerifyBuffer(data, size)) { + return; + } auto struct_map = flexbuffers::GetRoot(data, size).AsMap(); fetched.Deserialize(struct_map["fetched"].AsString().str()); active.Deserialize(struct_map["active"].AsString().str()); diff --git a/remote_config/src/desktop/file_manager.cc b/remote_config/src/desktop/file_manager.cc index f4cf5aeb5f..43bffbe430 100644 --- a/remote_config/src/desktop/file_manager.cc +++ b/remote_config/src/desktop/file_manager.cc @@ -37,10 +37,14 @@ namespace internal { RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename, const firebase::App& app) { std::string app_data_prefix = - std::string(app.options().package_name()) + "/" + app.name(); - std::string file_path = - AppDataDir(app_data_prefix.c_str(), /*should_create=*/true) + "/" + - filename; + std::string(app.options().package_name()) + "/remote_config"; + std::string error; + std::string app_dir = + AppDataDir(app_data_prefix.c_str(), /*should_create=*/true, &error); + std::string file_path; + if (error.empty() && !app_dir.empty()) { + file_path = app_dir + "/" + app.name() + "_" + filename; + } #if FIREBASE_PLATFORM_WINDOWS std::wstring_convert> utf8_to_wstring; file_path_ = utf8_to_wstring.from_bytes(file_path); @@ -50,7 +54,13 @@ RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename, } bool RemoteConfigFileManager::Load(LayeredConfigs* configs) const { + if (file_path_.empty()) { + return false; + } std::fstream input(file_path_, std::ios::in | std::ios::binary); + if (!input) { + return false; + } std::stringstream ss; ss << input.rdbuf(); configs->Deserialize(ss.str()); @@ -58,8 +68,14 @@ bool RemoteConfigFileManager::Load(LayeredConfigs* configs) const { } bool RemoteConfigFileManager::Save(const LayeredConfigs& configs) const { + if (file_path_.empty()) { + return false; + } std::string buffer = configs.Serialize(); std::fstream output(file_path_, std::ios::out | std::ios::binary); + if (!output) { + return false; + } output.write(buffer.c_str(), buffer.size()); return true; } diff --git a/remote_config/src/desktop/metadata.cc b/remote_config/src/desktop/metadata.cc index ceca1c07fa..dad657398f 100644 --- a/remote_config/src/desktop/metadata.cc +++ b/remote_config/src/desktop/metadata.cc @@ -14,7 +14,10 @@ #include "remote_config/src/desktop/metadata.h" +#include #include +#include +#include #include #include @@ -59,6 +62,9 @@ std::string RemoteConfigMetadata::Serialize() const { void RemoteConfigMetadata::Deserialize(const std::string& buffer) { const uint8_t* data = reinterpret_cast(buffer.data()); size_t size = buffer.size(); + if (!flexbuffers::VerifyBuffer(data, size)) { + return; + } auto struct_map = flexbuffers::GetRoot(data, size).AsMap(); flexbuffers::Map info = struct_map["info"].AsMap(); @@ -76,7 +82,18 @@ void RemoteConfigMetadata::Deserialize(const std::string& buffer) { settings_.clear(); flexbuffers::Map settings = struct_map["settings"].AsMap(); for (int i = 0, n = settings.size(); i < n; ++i) { - int int_key = std::stoi(settings.Keys()[i].AsKey()); + const char* key_str = settings.Keys()[i].AsKey(); + if (!key_str) continue; + char* endptr = nullptr; + long raw_key = std::strtol(key_str, &endptr, 10); + if (endptr == key_str || *endptr != '\0') { + continue; + } + if (raw_key < std::numeric_limits::min() || + raw_key > std::numeric_limits::max()) { + continue; + } + int int_key = static_cast(raw_key); settings_[static_cast(int_key)] = settings.Values()[i].AsString().c_str(); } diff --git a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch deleted file mode 100644 index 7a3b3a70ae..0000000000 --- a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch +++ /dev/null @@ -1,32 +0,0 @@ -From b08adb291f3ae0a2626d50eb8abecbc3a0de63d9 Mon Sep 17 00:00:00 2001 -From: "almostmatt@google.com" -Date: Fri, 21 Apr 2023 14:31:06 -0400 -Subject: [PATCH] remove unused var - ---- - src/idl_gen_rust.cpp | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/idl_gen_rust.cpp b/src/idl_gen_rust.cpp -index 55b8439b..48539d52 100644 ---- a/src/idl_gen_rust.cpp -+++ b/src/idl_gen_rust.cpp -@@ -406,7 +406,6 @@ class RustGenerator : public BaseGenerator { - // example: f(A, D::E) -> super::D::E - // does not include leaf object (typically a struct type). - -- size_t i = 0; - std::stringstream stream; - - auto s = src->components.begin(); -@@ -417,7 +416,6 @@ class RustGenerator : public BaseGenerator { - if (*s != *d) { break; } - ++s; - ++d; -- ++i; - } - - for (; s != src->components.end(); ++s) { stream << "super::"; } --- -2.40.1.606.ga4b1b128d6-goog - From c50d7211340efd5fccffd5a11f745155f027bdcc Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Thu, 4 Jun 2026 10:59:53 -0400 Subject: [PATCH 02/18] Handle new FBT_MAX_TYPE in flatbuffers --- app/src/variant_util.cc | 4 ++++ database/src/desktop/persistence/flatbuffer_conversions.cc | 4 ++++ remote_config/src/desktop/remote_config_response.cc | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/app/src/variant_util.cc b/app/src/variant_util.cc index ca9249e08d..b729cfabf4 100644 --- a/app/src/variant_util.cc +++ b/app/src/variant_util.cc @@ -250,6 +250,10 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { case flexbuffers::FBT_BLOB: LogError("Flexbuffers containing blobs are not supported."); break; + case flexbuffers::FBT_MAX_TYPE: + LogError("Unknown or unsupported flexbuffer type: %d", + static_cast(ref.GetType())); + break; } return Variant::Null(); } diff --git a/database/src/desktop/persistence/flatbuffer_conversions.cc b/database/src/desktop/persistence/flatbuffer_conversions.cc index b8946309b9..c3e7157af4 100644 --- a/database/src/desktop/persistence/flatbuffer_conversions.cc +++ b/database/src/desktop/persistence/flatbuffer_conversions.cc @@ -103,6 +103,10 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { case flexbuffers::FBT_BLOB: LogError("Flexbuffers containing blobs are not supported."); break; + case flexbuffers::FBT_MAX_TYPE: + LogError("Unknown or unsupported flexbuffer type: %d", + static_cast(ref.GetType())); + break; } return Variant::Null(); } diff --git a/remote_config/src/desktop/remote_config_response.cc b/remote_config/src/desktop/remote_config_response.cc index 397c1f5d9e..8143640bc4 100644 --- a/remote_config/src/desktop/remote_config_response.cc +++ b/remote_config/src/desktop/remote_config_response.cc @@ -81,6 +81,10 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { case flexbuffers::FBT_BLOB: LogError("Flexbuffers containing blobs are not supported."); break; + case flexbuffers::FBT_MAX_TYPE: + LogError("Unknown or unsupported flexbuffer type: %d", + static_cast(ref.GetType())); + break; } return Variant::Null(); } From dde589e47778bc6e5b33fedb294c3fbacbbb59f9 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Fri, 5 Jun 2026 14:06:16 -0400 Subject: [PATCH 03/18] Fix the GenerateText response --- app/rest/request_json.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/rest/request_json.h b/app/rest/request_json.h index 8f3cfc9fc8..a42ca27851 100644 --- a/app/rest/request_json.h +++ b/app/rest/request_json.h @@ -66,7 +66,7 @@ class RequestJson : public Request { // Generate JSON string. std::string json; bool generate_status = - GenerateText(*parser_, builder.GetBufferPointer(), &json); + GenerateText(*parser_, builder.GetBufferPointer(), &json) == nullptr; FIREBASE_ASSERT_RETURN_VOID(generate_status); set_post_fields(json.c_str()); From 1dde56aa55822ba8136a3dc726fc1cb4b3db2330 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Mon, 8 Jun 2026 14:56:30 -0400 Subject: [PATCH 04/18] Patch flatbuffers to resolve ERROR macro conflict on Windows --- cmake/external/flatbuffers.cmake | 3 ++ .../flatbuffers/0001-fix-error-macro.patch | 35 +++++++++++++++++++ 2 files changed, 38 insertions(+) create mode 100644 scripts/git/patches/flatbuffers/0001-fix-error-macro.patch diff --git a/cmake/external/flatbuffers.cmake b/cmake/external/flatbuffers.cmake index c79d686db4..c2c8c7e34e 100644 --- a/cmake/external/flatbuffers.cmake +++ b/cmake/external/flatbuffers.cmake @@ -20,6 +20,8 @@ endif() # Commit corresponds to Tag v25.12.19-2026-02-06-03fffb2 set(version 95fda8c23e6e30ebd975892b5fad01efa53e039c) +set(patch_file + ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-fix-error-macro.patch) ExternalProject_Add( flatbuffers @@ -28,6 +30,7 @@ ExternalProject_Add( COMMAND git init flatbuffers COMMAND cd flatbuffers && git fetch --depth=1 https://github.com/google/flatbuffers.git ${version} && git reset --hard FETCH_HEAD + PATCH_COMMAND git apply ${patch_file} PREFIX ${PROJECT_BINARY_DIR} CONFIGURE_COMMAND "" diff --git a/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch b/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch new file mode 100644 index 0000000000..068ed0fdac --- /dev/null +++ b/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch @@ -0,0 +1,35 @@ +From: Antigravity +Subject: Patch flatbuffers to resolve ERROR macro conflict on Windows + +Workaround for conflict between ProtoIdGapAction::ERROR in idl.h and the +Windows global ERROR macro defined in wingdi.h/windows.h. + +See Flatbuffers Issue: https://github.com/google/flatbuffers/issues/8483 + +diff --git a/include/flatbuffers/idl.h b/include/flatbuffers/idl.h +index 95fda8c2..6da1c6e3 100644 +--- a/include/flatbuffers/idl.h ++++ b/include/flatbuffers/idl.h +@@ -17,6 +17,12 @@ + #ifndef FLATBUFFERS_IDL_H_ + #define FLATBUFFERS_IDL_H_ + ++#ifdef ERROR ++#pragma push_macro("ERROR") ++#undef ERROR ++#define FLATBUFFERS_POP_ERROR_MACRO ++#endif ++ + #include + #include + #include +@@ -1325,4 +1331,9 @@ extern bool GenerateTSGRPC(const Parser& parser, const std::string& path, + const std::string& file_name); + } // namespace flatbuffers + ++#ifdef FLATBUFFERS_POP_ERROR_MACRO ++#pragma pop_macro("ERROR") ++#undef FLATBUFFERS_POP_ERROR_MACRO ++#endif ++ + #endif // FLATBUFFERS_IDL_H_ From 020267687da576f0f8a916c955c0cd2d1f9c018b Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Mon, 8 Jun 2026 16:59:32 -0400 Subject: [PATCH 05/18] Add release notes --- release_build_files/readme.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/release_build_files/readme.md b/release_build_files/readme.md index 62cfb27116..0377f14767 100644 --- a/release_build_files/readme.md +++ b/release_build_files/readme.md @@ -613,6 +613,10 @@ workflow use only during the development of your app, not for publicly shipping code. ## Release Notes +### Upcoming +- Changes + - Remote Config (Desktop): Updated Flatbuffers to latest version to support buffer verification. Added flexbuffer integrity checks before parsing to prevent crashes on invalid/malformed data. + ### 13.9.0 - Changes - General (Android): Update to Firebase Android BoM version 34.15.0. From 51f3395b3432ba8074cbbf2504e176a3174be44a Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Mon, 8 Jun 2026 19:58:01 -0400 Subject: [PATCH 06/18] Restore 0001-remove-unused-var.patch for Android flatbuffers v1.12.0 build --- .../flatbuffers/0001-remove-unused-var.patch | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 scripts/git/patches/flatbuffers/0001-remove-unused-var.patch diff --git a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch new file mode 100644 index 0000000000..6bd51cbd5c --- /dev/null +++ b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch @@ -0,0 +1,31 @@ +From b08adb291f3ae0a2626d50eb8abecbc3a0de63d9 Mon Sep 17 00:00:00 2001 +From: "almostmatt@google.com" +Date: Fri, 21 Apr 2023 14:31:06 -0400 +Subject: [PATCH] remove unused var + +--- + src/idl_gen_rust.cpp | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/idl_gen_rust.cpp b/src/idl_gen_rust.cpp +index 55b8439b..48539d52 100644 +--- a/src/idl_gen_rust.cpp ++++ b/src/idl_gen_rust.cpp +@@ -406,7 +406,6 @@ class RustGenerator : public BaseGenerator { + // example: f(A, D::E) -> super::D::E + // does not include leaf object (typically a struct type). + +- size_t i = 0; + std::stringstream stream; + + auto s = src->components.begin(); +@@ -417,7 +416,6 @@ class RustGenerator : public BaseGenerator { + if (*s != *d) { break; } + ++s; + ++d; +- ++i; + } + + for (; s != src->components.end(); ++s) { stream << "super::"; } +-- +2.40.1.606.ga4b1b128d6-goog From 8938c3b2e215ce4ccfccc077004ebdc575bc64f5 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 9 Jun 2026 09:46:00 -0400 Subject: [PATCH 07/18] Use cp -RL on Windows to avoid symbolic link creation failure --- build_scripts/android/build.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/build_scripts/android/build.sh b/build_scripts/android/build.sh index 0f4d63cb94..e2809a6a55 100755 --- a/build_scripts/android/build.sh +++ b/build_scripts/android/build.sh @@ -81,6 +81,5 @@ if [[ $(uname) == "Linux" ]] || [[ $(uname) == "Darwin" ]]; then else # rsync has to be specifically installed on windows bash (including github runners) # Also, rsync with absolute destination path doesn't work on Windows. - # Using a simple copy instead of rsync on Windows. - cp -R --parents "${paths[@]}" "${absbuildpath}" + cp -RL --parents "${paths[@]}" "${absbuildpath}" fi From 9850a4ce6d2799ab00d2fb7cff3d4d672cfc563c Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 15:24:33 -0400 Subject: [PATCH 08/18] Address code review feedback on remote_config desktop implementation --- remote_config/src/desktop/file_manager.cc | 3 ++- remote_config/src/desktop/metadata.cc | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/remote_config/src/desktop/file_manager.cc b/remote_config/src/desktop/file_manager.cc index 43bffbe430..c2578fe33d 100644 --- a/remote_config/src/desktop/file_manager.cc +++ b/remote_config/src/desktop/file_manager.cc @@ -36,8 +36,9 @@ namespace internal { RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename, const firebase::App& app) { + const char* package_name = app.options().package_name(); std::string app_data_prefix = - std::string(app.options().package_name()) + "/remote_config"; + std::string(package_name ? package_name : "") + "/remote_config"; std::string error; std::string app_dir = AppDataDir(app_data_prefix.c_str(), /*should_create=*/true, &error); diff --git a/remote_config/src/desktop/metadata.cc b/remote_config/src/desktop/metadata.cc index dad657398f..53c176a9e0 100644 --- a/remote_config/src/desktop/metadata.cc +++ b/remote_config/src/desktop/metadata.cc @@ -85,8 +85,9 @@ void RemoteConfigMetadata::Deserialize(const std::string& buffer) { const char* key_str = settings.Keys()[i].AsKey(); if (!key_str) continue; char* endptr = nullptr; + errno = 0; long raw_key = std::strtol(key_str, &endptr, 10); - if (endptr == key_str || *endptr != '\0') { + if (endptr == key_str || *endptr != '\0' || errno == ERANGE) { continue; } if (raw_key < std::numeric_limits::min() || From aa64115c120a09a798e8d4164d08b482d7b7c31f Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 16:25:24 -0400 Subject: [PATCH 09/18] Revert minor whitespace change in 0001-remove-unused-var.patch --- scripts/git/patches/flatbuffers/0001-remove-unused-var.patch | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch index 6bd51cbd5c..7a3b3a70ae 100644 --- a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch +++ b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch @@ -29,3 +29,4 @@ index 55b8439b..48539d52 100644 for (; s != src->components.end(); ++s) { stream << "super::"; } -- 2.40.1.606.ga4b1b128d6-goog + From 700c4f68de6cb76f79fbad56a5103c37aea54de8 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 20:25:03 -0400 Subject: [PATCH 10/18] Add default case to FlexbufferToVariant switch to handle unknown/corrupt types --- remote_config/src/desktop/remote_config_response.cc | 1 + 1 file changed, 1 insertion(+) diff --git a/remote_config/src/desktop/remote_config_response.cc b/remote_config/src/desktop/remote_config_response.cc index 8143640bc4..e3e8b5890c 100644 --- a/remote_config/src/desktop/remote_config_response.cc +++ b/remote_config/src/desktop/remote_config_response.cc @@ -82,6 +82,7 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { LogError("Flexbuffers containing blobs are not supported."); break; case flexbuffers::FBT_MAX_TYPE: + default: LogError("Unknown or unsupported flexbuffer type: %d", static_cast(ref.GetType())); break; From b9128e1a69b4e4d47597a823dd6a2197be561278 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 20:27:41 -0400 Subject: [PATCH 11/18] Fix incorrect GenerateText return value comparison to nullptr --- app/rest/request_json.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/rest/request_json.h b/app/rest/request_json.h index a42ca27851..8f3cfc9fc8 100644 --- a/app/rest/request_json.h +++ b/app/rest/request_json.h @@ -66,7 +66,7 @@ class RequestJson : public Request { // Generate JSON string. std::string json; bool generate_status = - GenerateText(*parser_, builder.GetBufferPointer(), &json) == nullptr; + GenerateText(*parser_, builder.GetBufferPointer(), &json); FIREBASE_ASSERT_RETURN_VOID(generate_status); set_post_fields(json.c_str()); From 3b6dbc8caf1ed78a8013337fc5e395144311b8d1 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 20:33:22 -0400 Subject: [PATCH 12/18] Add default case to FlexbufferToVariant switches in app and database modules --- app/src/variant_util.cc | 1 + database/src/desktop/persistence/flatbuffer_conversions.cc | 1 + 2 files changed, 2 insertions(+) diff --git a/app/src/variant_util.cc b/app/src/variant_util.cc index b729cfabf4..3176f1212d 100644 --- a/app/src/variant_util.cc +++ b/app/src/variant_util.cc @@ -251,6 +251,7 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { LogError("Flexbuffers containing blobs are not supported."); break; case flexbuffers::FBT_MAX_TYPE: + default: LogError("Unknown or unsupported flexbuffer type: %d", static_cast(ref.GetType())); break; diff --git a/database/src/desktop/persistence/flatbuffer_conversions.cc b/database/src/desktop/persistence/flatbuffer_conversions.cc index c3e7157af4..29f2b22e61 100644 --- a/database/src/desktop/persistence/flatbuffer_conversions.cc +++ b/database/src/desktop/persistence/flatbuffer_conversions.cc @@ -104,6 +104,7 @@ Variant FlexbufferToVariant(const flexbuffers::Reference& ref) { LogError("Flexbuffers containing blobs are not supported."); break; case flexbuffers::FBT_MAX_TYPE: + default: LogError("Unknown or unsupported flexbuffer type: %d", static_cast(ref.GetType())); break; From ca07b971983235868003cab4311225cade33dec2 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 20:52:14 -0400 Subject: [PATCH 13/18] Avoid leading slash in app_data_prefix when package_name is empty/null --- remote_config/src/desktop/file_manager.cc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/remote_config/src/desktop/file_manager.cc b/remote_config/src/desktop/file_manager.cc index c2578fe33d..7bf010d087 100644 --- a/remote_config/src/desktop/file_manager.cc +++ b/remote_config/src/desktop/file_manager.cc @@ -38,7 +38,9 @@ RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename, const firebase::App& app) { const char* package_name = app.options().package_name(); std::string app_data_prefix = - std::string(package_name ? package_name : "") + "/remote_config"; + (package_name && package_name[0] != '\0') + ? std::string(package_name) + "/remote_config" + : "remote_config"; std::string error; std::string app_dir = AppDataDir(app_data_prefix.c_str(), /*should_create=*/true, &error); From cf6501eb2a5add4963888eb9d13e936f7008bbaa Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 20:55:43 -0400 Subject: [PATCH 14/18] Add defensive null check for configs in RemoteConfigFileManager::Load --- remote_config/src/desktop/file_manager.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/remote_config/src/desktop/file_manager.cc b/remote_config/src/desktop/file_manager.cc index 7bf010d087..d062cf4b87 100644 --- a/remote_config/src/desktop/file_manager.cc +++ b/remote_config/src/desktop/file_manager.cc @@ -57,7 +57,7 @@ RemoteConfigFileManager::RemoteConfigFileManager(const std::string& filename, } bool RemoteConfigFileManager::Load(LayeredConfigs* configs) const { - if (file_path_.empty()) { + if (!configs || file_path_.empty()) { return false; } std::fstream input(file_path_, std::ios::in | std::ios::binary); From 9aa9d5c7c5134db9e861abd78570c85ca5c672f9 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 21:16:15 -0400 Subject: [PATCH 15/18] Fix logic inversion in RequestJson serialization assertion --- app/rest/request_json.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/rest/request_json.h b/app/rest/request_json.h index 8f3cfc9fc8..a42ca27851 100644 --- a/app/rest/request_json.h +++ b/app/rest/request_json.h @@ -66,7 +66,7 @@ class RequestJson : public Request { // Generate JSON string. std::string json; bool generate_status = - GenerateText(*parser_, builder.GetBufferPointer(), &json); + GenerateText(*parser_, builder.GetBufferPointer(), &json) == nullptr; FIREBASE_ASSERT_RETURN_VOID(generate_status); set_post_fields(json.c_str()); From 8e06e5c739962ff62fce8b793bccac0273463aed Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Tue, 23 Jun 2026 23:05:59 -0400 Subject: [PATCH 16/18] Pin flatbuffers to official v25.12.19 release commit 7e163021 --- cmake/external/flatbuffers.cmake | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmake/external/flatbuffers.cmake b/cmake/external/flatbuffers.cmake index c2c8c7e34e..91f054b89e 100644 --- a/cmake/external/flatbuffers.cmake +++ b/cmake/external/flatbuffers.cmake @@ -18,8 +18,8 @@ if(TARGET flatbuffers OR NOT DOWNLOAD_FLATBUFFERS) return() endif() -# Commit corresponds to Tag v25.12.19-2026-02-06-03fffb2 -set(version 95fda8c23e6e30ebd975892b5fad01efa53e039c) +# Pinned to the official v25.12.19 release commit to ensure stability. +set(version 7e163021e59cca4f8e1e35a7c828b5c6b7915953) set(patch_file ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-fix-error-macro.patch) From 1eb093de47190a46ac8082b221a51cc374823aee Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Wed, 24 Jun 2026 10:05:38 -0400 Subject: [PATCH 17/18] Unify C++ and Java FlatBuffers versions to v25.2.10 --- cmake/external/flatbuffers.cmake | 4 +-- messaging/messaging_java/build.gradle | 15 +++------ .../flatbuffers/0001-remove-unused-var.patch | 32 ------------------- 3 files changed, 6 insertions(+), 45 deletions(-) delete mode 100644 scripts/git/patches/flatbuffers/0001-remove-unused-var.patch diff --git a/cmake/external/flatbuffers.cmake b/cmake/external/flatbuffers.cmake index 91f054b89e..b204a9ca28 100644 --- a/cmake/external/flatbuffers.cmake +++ b/cmake/external/flatbuffers.cmake @@ -18,8 +18,8 @@ if(TARGET flatbuffers OR NOT DOWNLOAD_FLATBUFFERS) return() endif() -# Pinned to the official v25.12.19 release commit to ensure stability. -set(version 7e163021e59cca4f8e1e35a7c828b5c6b7915953) +# Pinned to the official v25.2.10 release commit to ensure stability and match Java library. +set(version 1c514626e83c20fffa8557e75641848e1e15cd5e) set(patch_file ${CMAKE_CURRENT_LIST_DIR}/../../scripts/git/patches/flatbuffers/0001-fix-error-macro.patch) diff --git a/messaging/messaging_java/build.gradle b/messaging/messaging_java/build.gradle index c41502b654..38f8e15146 100644 --- a/messaging/messaging_java/build.gradle +++ b/messaging/messaging_java/build.gradle @@ -24,7 +24,7 @@ buildscript { // that requires using a newer version of the JDK and at least Android N. // This has already been fixed at head, but a tagged release is not yet // available with that fix. - classpath 'com.google.flatbuffers:flatbuffers-java:1.12.0' + classpath 'com.google.flatbuffers:flatbuffers-java:25.2.10' } } allprojects { @@ -64,7 +64,7 @@ dependencies { implementation platform('com.google.firebase:firebase-bom:34.15.0') implementation 'com.google.firebase:firebase-analytics' implementation 'com.google.firebase:firebase-messaging' - implementation 'com.google.flatbuffers:flatbuffers-java:1.12.0' + implementation 'com.google.flatbuffers:flatbuffers-java:25.2.10' } afterEvaluate { @@ -81,20 +81,13 @@ afterEvaluate { executable 'git' args 'clone', '--branch', - 'v1.12.0', + 'v25.2.10', '--depth', '1', 'https://github.com/google/flatbuffers.git', flatbuffersDir } - exec { - executable 'git' - args 'apply', - '../../scripts/git/patches/flatbuffers/0001-remove-unused-var.patch', - '--verbose', - '--directory', - 'messaging/messaging_java/build/flatbuffers' - } + } // Locate or build flatc. diff --git a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch b/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch deleted file mode 100644 index 7a3b3a70ae..0000000000 --- a/scripts/git/patches/flatbuffers/0001-remove-unused-var.patch +++ /dev/null @@ -1,32 +0,0 @@ -From b08adb291f3ae0a2626d50eb8abecbc3a0de63d9 Mon Sep 17 00:00:00 2001 -From: "almostmatt@google.com" -Date: Fri, 21 Apr 2023 14:31:06 -0400 -Subject: [PATCH] remove unused var - ---- - src/idl_gen_rust.cpp | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/idl_gen_rust.cpp b/src/idl_gen_rust.cpp -index 55b8439b..48539d52 100644 ---- a/src/idl_gen_rust.cpp -+++ b/src/idl_gen_rust.cpp -@@ -406,7 +406,6 @@ class RustGenerator : public BaseGenerator { - // example: f(A, D::E) -> super::D::E - // does not include leaf object (typically a struct type). - -- size_t i = 0; - std::stringstream stream; - - auto s = src->components.begin(); -@@ -417,7 +416,6 @@ class RustGenerator : public BaseGenerator { - if (*s != *d) { break; } - ++s; - ++d; -- ++i; - } - - for (; s != src->components.end(); ++s) { stream << "super::"; } --- -2.40.1.606.ga4b1b128d6-goog - From dad5112c106e32f3fcfd2c872a449bd3fbe85125 Mon Sep 17 00:00:00 2001 From: AustinBenoit Date: Wed, 24 Jun 2026 12:35:44 -0400 Subject: [PATCH 18/18] Update FlatBuffers patch for v25.2.10 formatting compatibility on Windows --- scripts/git/patches/flatbuffers/0001-fix-error-macro.patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch b/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch index 068ed0fdac..7d8aef4c7a 100644 --- a/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch +++ b/scripts/git/patches/flatbuffers/0001-fix-error-macro.patch @@ -23,8 +23,8 @@ index 95fda8c2..6da1c6e3 100644 #include #include #include -@@ -1325,4 +1331,9 @@ extern bool GenerateTSGRPC(const Parser& parser, const std::string& path, - const std::string& file_name); +@@ -1300,4 +1306,9 @@ extern bool GenerateTSGRPC(const Parser &parser, const std::string &path, + const std::string &file_name); } // namespace flatbuffers +#ifdef FLATBUFFERS_POP_ERROR_MACRO