From 4f1003df813bca58f4f9d9798a1205d27230c25b Mon Sep 17 00:00:00 2001 From: Antoine Pietri Date: Mon, 3 Aug 2026 05:08:13 -0700 Subject: [PATCH] Pass message_factory to reflection->GetMessage in cel::Value::WrapField. Inside WrapFieldImpl in value.cc, CEL called reflection->GetMessage(*message, field) without passing message_factory as the 3rd argument. When message is a compiled C++ GeneratedMessage, Protobuf reflection defaulted factory to MessageFactory::generated_factory(). If field is an extension whose descriptor lives in a dynamic DescriptorPool, generated_factory()->GetPrototype(extension_desc) returns nullptr, causing a SIGSEGV (@(nil)) in ExtensionSet::GetMessage(). This CL passes message_factory to reflection->GetMessage(*message, field, message_factory) so Protobuf reflection uses CEL's MessageFactory to resolve dynamic extensions. PiperOrigin-RevId: 958311978 --- common/value.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/common/value.cc b/common/value.cc index 6284626da..fdb18d388 100644 --- a/common/value.cc +++ b/common/value.cc @@ -1583,11 +1583,12 @@ Value WrapFieldImpl( } if constexpr (Unsafe::value) { return Value::WrapMessageUnsafe( - &reflection->GetMessage(*message, field), descriptor_pool, - message_factory, arena); + &reflection->GetMessage(*message, field, message_factory), + descriptor_pool, message_factory, arena); } else { - return Value::WrapMessage(&reflection->GetMessage(*message, field), - descriptor_pool, message_factory, arena); + return Value::WrapMessage( + &reflection->GetMessage(*message, field, message_factory), + descriptor_pool, message_factory, arena); } case google::protobuf::FieldDescriptor::TYPE_BYTES: { std::string scratch;