Vulnerability: Memory leak in Nanopb ### Impact
Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

### Patches
Preliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

### Workarounds
Following workarounds are available:
* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.
* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.
* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

### References
Bug report: https://github.com/nanopb/nanopb/issues/615

### For more information
If you have any questions or comments about this advisory, comment on the bug report linked above.
Vulnerability ID: GHSA-85rr-4rh9-hhwh
CWE: CWE-119
Severity score: 7.5
Project: https://github.com/nanopb/nanopb
Published: 2020-11-25
File: pb_decode.c
Commit message: Fix memory leak with oneofs and PB_ENABLE_MALLOC (#615)

Nanopb would leak memory when all of the following conditions were true:
- PB_ENABLE_MALLOC is defined at the compile time
- Message definitions contains an oneof field,
  the oneof contains a static submessage, and
  the static submessage contains a pointer field.
- Data being decoded contains two values for the submessage.

The logic in pb_release_union_field would detect that the same
submessage occurs twice, and wouldn't release it because keeping
the old values is necessary to match the C++ library behavior
regarding message merges.

But then decode_static_field() would go to memset() the whole
submessage to zero, because it unconditionally assumed it to
be uninitialized memory. This would normally happen when the
contents of the union field is switched to a different oneof
item, instead of merging with the same one.

This commit changes it so that the field is memset() only when
`which_field` contains a different tag.
Commit author: Petteri Aimonen

Vulnerable version (before fix):
 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t             }          case PB_HTYPE_ONEOF:             *(pb_size_t*)iter->pSize = iter->pos->tag;             if (PB_LTYPE(type) == PB_LTYPE_SUBMESSAGE)             {                 /* We memset to zero so that any callbacks are set to NULL.                  * Then set any default values. */                 memset(iter->pData, 0, iter->pos->data_size);                 pb_message_set_to_defaults((const pb_field_t*)iter->pos->ptr, iter->pData);             }             return func(stream, iter->pos, iter->pData);          default:

Fixed version (after fix):
 static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t             }          case PB_HTYPE_ONEOF:             if (PB_LTYPE(type) == PB_LTYPE_SUBMESSAGE &&                 *(pb_size_t*)iter->pSize != iter->pos->tag)             {                 /* We memset to zero so that any callbacks are set to NULL.                  * This is because the callbacks might otherwise have values                  * from some other union field. */                 memset(iter->pData, 0, iter->pos->data_size);                 pb_message_set_to_defaults((const pb_field_t*)iter->pos->ptr, iter->pData);             }             *(pb_size_t*)iter->pSize = iter->pos->tag;              return func(stream, iter->pos, iter->pData);          default:

Patch:
patch: @@ -464,14 +464,17 @@ static bool checkreturn decode_static_field(pb_istream_t *stream, pb_wire_type_t
             }
 
         case PB_HTYPE_ONEOF:
-            *(pb_size_t*)iter->pSize = iter->pos->tag;
-            if (PB_LTYPE(type) == PB_LTYPE_SUBMESSAGE)
+            if (PB_LTYPE(type) == PB_LTYPE_SUBMESSAGE &&
+                *(pb_size_t*)iter->pSize != iter->pos->tag)
             {
                 /* We memset to zero so that any callbacks are set to NULL.
-                 * Then set any default values. */
+                 * This is because the callbacks might otherwise have values
+                 * from some other union field. */
                 memset(iter->pData, 0, iter->pos->data_size);
                 pb_message_set_to_defaults((const pb_field_t*)iter->pos->ptr, iter->pData);
             }
+            *(pb_size_t*)iter->pSize = iter->pos->tag;
+
             return func(stream, iter->pos, iter->pData);
 
         default:
path: pb_decode.c