[Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE)

[alimezar]

Summary

getCheckedRoot accepted malformed FlatBuffers whose scalar vector element count did not match the available payload bytes. After verification succeeded, the generated accessors and mutators read and wrote past ByteBuffer.capacity, producing out-of-bounds memory disclosure, out-of-bounds memory corruption, and code execution when corrupted adjacent control data was later invoked.

Reported as Google IssueTracker issue 510740173.

Root cause

Verifiable.verifyRange passed the vector element count directly to rangeInBuffer as a byte count. For any scalar vector whose element size is greater than one byte (e.g. [long], [int], [double]), the declared length only had to fit byteBuffer.capacity bytes after the vector header instead of count * elementSize bytes, so a buffer declaring N elements but containing only N raw bytes was accepted.

Fix

Multiply the declared element count by MemoryLayout<T>.size with overflow detection and pass the resulting byte size to rangeInBuffer, so truncated scalar vectors are rejected at verification time before any unsafe generated access can occur.

[mustiikhalil]

@alimezar Thanks for your PR, I am wondering if you can wait on merging it until the following PR lands (should be today).

1- If the swift Testing changes land today, then you would need to convert the test case to use swift testing, and if possible add a link to the ticket similar to the example below:

  @Test(.bug("https://github.com/google/flatbuffers/issues/8642"))
  func testReset() throws {}

2. If they don't land today, if possible can you still give me a link to a ticket (if the ticket is public) so I can add it to the converted test.

[alimezar]

Hi @mustiikhalil. The IssueTracker entry is private so I've opened a public issue

Regarding the PR I dont mind waiting, once it lands I'll rebase and convert the regression test to Swift Testing.

Thank you.

[mustiikhalil]

@alimezar Swift testing PR is merged

[alimezar]

Hi @mustiikhalil,

Rebased onto master and converted the regression test to Swift Testing.

[mustiikhalil]

LGTM!

@alimezar Thanks for opening a PR, and help improving the swift port 🎉