[C++] Parsing crashes with segmentation fault when clang is used, since protobuf >= 29

[koxu1996]

Problem Description

After updating protobuf to v29, my clang-compiled app started crashing on parsing - TcParser::FastMtS1 call:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff7e43c17 in google::protobuf::internal::TcParser::FastMtS1(google::protobuf::MessageLite*, char const*, google::protobuf::internal::ParseContext*, google::protobuf::internal::TcFieldData, google::protobuf::internal::TcParseTableBase const*, unsigned long) () from /nix/store/s0521fkq7z9lycdgal6y7g726vz5d6zk-protobuf-29.4/lib/libprotobuf.so.29.4.0
#2  0x00007ffff7ece3aa in bool google::protobuf::internal::MergeFromImpl<false>(google::protobuf::io::ZeroCopyInputStream*, google::protobuf::MessageLite*, google::protobuf::internal::TcParseTableBase const*, google::protobuf::MessageLite::ParseFlags) ()
   from /nix/store/s0521fkq7z9lycdgal6y7g726vz5d6zk-protobuf-29.4/lib/libprotobuf.so.29.4.0
#3  0x00007ffff7ecd877 in google::protobuf::MessageLite::ParseFromIstream(std::basic_istream<char, std::char_traits<char> >*) () from /nix/store/s0521fkq7z9lycdgal6y7g726vz5d6zk-protobuf-29.4/lib/libprotobuf.so.29.4.0
#4  0x00005555555578c9 in main ()

Reproducing with Nix

1. Create message.proto:

syntax = "proto3";

message Settings {
  bool email_notifications = 1;
  string theme = 2;
}

message User {
  string username = 1;
  string email = 2;
  Settings preferences = 3;
}

2. Create main.cc:

#include <iostream>
#include <fstream>
#include "message.pb.h"

int main() {
  GOOGLE_PROTOBUF_VERIFY_VERSION;

  std::cout << "🔧 Creating a user message..." << std::endl;

  // Create the settings
  Settings prefs;
  prefs.set_email_notifications(true);
  prefs.set_theme("dark");

  // Create the user
  User user;
  user.set_username("johndoe");
  user.set_email("john@example.com");
  *user.mutable_preferences() = prefs;

  std::cout << "📦 Serializing to 'input.bin'..." << std::endl;

  std::ofstream output("input.bin", std::ios::binary);
  if (!output) {
    std::cerr << "❌ Failed to open 'input.bin' for writing." << std::endl;
    return 1;
  }
  if (!user.SerializeToOstream(&output)) {
    std::cerr << "❌ Failed to write protobuf message to file." << std::endl;
    return 1;
  }

  output.close();
  std::cout << "✅ Serialization complete.\n" << std::endl;

  std::cout << "📂 Reading from 'input.bin'..." << std::endl;

  std::ifstream input("input.bin", std::ios::binary);
  if (!input) {
    std::cerr << "❌ Failed to open 'input.bin' for reading." << std::endl;
    return 1;
  }

  User read_user;
  if (!read_user.ParseFromIstream(&input)) {
    std::cerr << "❌ Failed to parse protobuf message from file." << std::endl;
    return 1;
  }

  std::cout << "✅ Successfully read and parsed the message:\n";
  std::cout << read_user.DebugString() << std::endl;

  google::protobuf::ShutdownProtobufLibrary();
  return 0;
}

3. Create flake.nix:

{
  description = "Example of protobuf parsing crash.";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs { inherit system; };

        protobuf = pkgs.protobuf_29; # Clang-compiled binary worked with version 28!
        stdenv = pkgs.stdenv;
        abseil = pkgs.abseil-cpp;
      in
      {
        packages.default = stdenv.mkDerivation {
          name = "proto-cpp-app";
          src = ./.;

          buildInputs = [ protobuf pkgs.clang pkgs.gcc pkgs.abseil-cpp ];

          buildPhase = ''
            # Generate C++ files from proto definitions.
            mkdir -p generated
            ${protobuf}/bin/protoc --cpp_out=./generated message.proto

            # Compile binary with Clang.
            clang++ -std=c++17 -Igenerated -I${protobuf}/include \
              main.cc generated/message.pb.cc \
              -L${abseil}/lib -labsl_log_internal_check_op -labsl_log_internal_message \
              -L${protobuf}/lib -lprotobuf -o proto-app-clang

            # Compile binary with GCC.
            g++ -std=c++17 -Igenerated -I${protobuf}/include \
              main.cc generated/message.pb.cc \
              -L${abseil}/lib -labsl_log_internal_check_op -labsl_log_internal_message \
              -L${protobuf}/lib -lprotobuf -o proto-app-gnu
          '';

          installPhase = ''
            mkdir -p $out/bin
            cp proto-app-* $out/bin/
          '';
        };
        devShells.default = pkgs.mkShell {
          name = "proto-dev-shell";

          buildInputs = [ protobuf pkgs.clang pkgs.gcc pkgs.abseil-cpp ];

          shellHook = ''
            echo "🚀 Protobuf dev shell with Clang/GCC/Abseil is ready"
          '';
        };
      });
}

NOTE: Here is my flake.lock.

4. Compile binary with nix develop.

5. Try running GCC-compiled version:

$ ./result/bin/proto-app-gnu
🔧 Creating a user message...
📦 Serializing to 'input.bin'...
✅ Serialization complete.

📂 Reading from 'input.bin'...
✅ Successfully read and parsed the message:
username: "johndoe"
email: "john@example.com"
preferences {
  email_notifications: true
  theme: "dark"
}

Works as expected 👌.

6. Try running clang-version:

$ ./result/bin/proto-app-clang
🔧 Creating a user message...
📦 Serializing to 'input.bin'...
✅ Serialization complete.

📂 Reading from 'input.bin'...
Segmentation fault (core dumped)

It crashed 😑.

What Is Wrong?

There is nothing wrong with Clang per se, but mixing compilers is dangerous 💣. I discovered that my protobuf library was compiled with GCC:

$ ldd ./result/bin/proto-app-clang | grep libprotobuf
        libprotobuf.so.29.4.0 => /nix/store/s0521fkq7z9lycdgal6y7g726vz5d6zk-protobuf-29.4/lib/libprotobuf.so.29.4.0 (0x00007f2f1a9d1000)
$ readelf -p .comment /nix/store/s0521fkq7z9lycdgal6y7g726vz5d6zk-protobuf-29.4/lib/libprotobuf.so.29.4.0

String dump of section '.comment':
  [     0]  GCC: (GNU) 14.2.1 20250322

Why it worked in previous protobuf version (v28)? I have no idea, but I am sharing it so someone else can understand what is happening - like in #20812.

[zhangskz]

@sbenzaquen Is mixing gcc-compiled protobuf with clang-compiled app expected to be supported. Do you know if anything changed around TcParser::FastMtS1 recently that may have broken this if so? Or if not, is there something we could add to help guard against / surface this?

[mortie]

I've hit this issue as well. It makes protobuf more or less unusable on macOS, since it affects the version of protobuf that's currently packaged in Homebrew.

I made my own little test program which just roundtrips a simple message. The crash produces this backtrace in lldb:

(lldb) target create "./roundtrip"
Current executable set to '/Users/martin/job.kompany/grpcpp-issue/roundtrip' (arm64).
(lldb) r
Process 63067 launched: '/Users/martin/job.kompany/grpcpp-issue/roundtrip' (arm64)
Successfully serialized to the following bytes:
0a 02 08 0a
Parsing...
Process 63067 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #0: 0x0000000000000000
error: memory read failed for 0x0
Target 0: (roundtrip) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000000000000
    frame #1: 0x00000001004e8fc0 libprotobuf.29.3.0.dylib`google::protobuf::internal::TcParser::AddMessage(google::protobuf::internal::TcParseTableBase const*, google::protobuf::internal::RepeatedPtrFieldBase&) + 124
    frame #2: 0x00000001004eaa6c libprotobuf.29.3.0.dylib`google::protobuf::internal::TcParser::FastMtR1(google::protobuf::MessageLite*, char const*, google::protobuf::internal::ParseContext*, google::protobuf::internal::TcFieldData, google::protobuf::internal::TcParseTableBase const*, unsigned long long) + 100
    frame #3: 0x000000010053d80c libprotobuf.29.3.0.dylib`bool google::protobuf::internal::MergeFromImpl<false>(std::__1::basic_string_view<char, std::__1::char_traits<char>>, google::protobuf::MessageLite*, google::protobuf::internal::TcParseTableBase const*, google::protobuf::MessageLite::ParseFlags) + 192
    frame #4: 0x000000010053f19c libprotobuf.29.3.0.dylib`google::protobuf::MessageLite::ParseFromString(std::__1::basic_string_view<char, std::__1::char_traits<char>>) + 24
    frame #5: 0x00000001000028c0 roundtrip`main at roundtrip.cc:28:12
    frame #6: 0x000000018e5f2b4c dyld`start + 6000

The test program is as follows:

#include "gen/testmessage.pb.h"
#include <iostream>

int main() {
    TestMessage a;
    a.add_foos()->set_x(10);

    std::string serialized;
    if (!a.SerializeToString(&serialized)) {
        std::cerr << "Oh no, serialize failed\n";
        return 1;
    }

    std::cout << "Successfully serialized to the following bytes:\n";
    std::cout << std::hex;
    for (char ch: serialized) {
        int num = int((unsigned char)ch);
        if (num < 0x10) {
            std::cout << '0' << num << ' ';
        } else {
            std::cout << num << ' ';
        }
    }
    std::cout << '\n';

    std::cout << "Parsing...\n";
    TestMessage b;
    if (!b.ParseFromString(serialized)) {
        std::cerr << "Oh no, parse failed\n";
        return 1;
    }

    return 0;
}

And the .proto file is:

syntax = "proto3";

message TestMessage {
    repeated Foo foos = 1;
}

message Foo {
  int32 x = 1;
}

It seems to crash when I have a repeated struct; so repeated Foo foos causes a crash, but e.g repeated string strings doesn't.

[twxs]

I've hit this issue with apple clang17. My app built with apple clang 16 works as expected.

[mortie]

After investigating some, I've found that building protobuf from source fixes the issue. So for Homebrew users on macOS, running brew reinstall --build-from-source protobuf is a workaround.

It's worrying that protobuf's ABI is so compiler- and compiler version-dependent, but this is no longer actively a blocker for me personally, thanks to the above workaround.

[twxs]

The protobuf library (30.2) was build from source with apple clang 16.
If my app is build with apple clang 17, the segmentation fault occurs while parsing a repeated field in MessageCreator::PlacementNew, the as_tag value is kFunc but the func_ is null.

Here the frame and backtrace :

google::protobuf::MessageLite* google::protobuf::internal::MessageCreator::PlacementNew<false, google::protobuf::MessageLite>(this=0x000000010ad06b80, prototype_for_func=0x000000010ad01020, prototype_for_copy=0x000000010ad01020, mem=0x000060000188c690, arena=0x0000000000000000) const at message_lite.h:1263:38
   1260	                "Only kFunc must be the only negative value");
   1261	  if (ABSL_PREDICT_FALSE(kMustBeFunc || as_tag < 0)) {
   1262	    PROTOBUF_DEBUG_COUNTER("MessageCreator.Func").Inc();
-> 1263	    return static_cast<MessageLite*>(func_(prototype_for_func, mem, arena));
    	                                     ^
   1264	  }
   1265	
   1266	  char* dst = static_cast<char*>(mem);

(lldb) p this->func_
(google::protobuf::internal::MessageCreator::Func) 0x0000000000000000

    frame #1: 0x000000010507006c `google::protobuf::MessageLite* google::protobuf::internal::MessageCreator::PlacementNew<false, google::protobuf::MessageLite>(this=0x000000010ad06b80, prototype_for_func=0x000000010ad01020, prototype_for_copy=0x000000010ad01020, mem=0x000060000188c690, arena=0x0000000000000000) const at message_lite.h:1263:38
    frame #2: 0x000000010506ff40 `google::protobuf::MessageLite* google::protobuf::internal::MessageCreator::New<false, google::protobuf::MessageLite>(this=0x000000010ad06b80, prototype_for_func=0x000000010ad01020, prototype_for_copy=0x000000010ad01020, arena=0x0000000000000000) const at message_lite.h:1354:10
    frame #3: 0x000000010506fe9c `google::protobuf::internal::ClassData::New(this=0x000000010ad06b58, arena=0x0000000000000000) const at message_lite.h:436:28
    frame #4: 0x000000010507e03c `google::protobuf::internal::TcParser::AddMessage(google::protobuf::internal::TcParseTableBase const*, google::protobuf::internal::RepeatedPtrFieldBase&)::$_0::operator()(google::protobuf::Arena*) const [inlined] google::protobuf::internal::TcParser::NewMessage(table=0x000000010ad06bc0, arena=0x0000000000000000) at generated_message_tctable_lite.cc:516:29
    frame #5: 0x000000010507e02c `google::protobuf::internal::TcParser::AddMessage(google::protobuf::internal::TcParseTableBase const*, google::protobuf::internal::RepeatedPtrFieldBase&)::$_0::operator()(this=0x000000016fdf9e28, arena=0x0000000000000000) const at generated_message_tctable_lite.cc:522:38
    frame #6: 0x000000010503cf30 Guitar Pro 9`void* google::protobuf::internal::RepeatedPtrFieldBase::AddInternal<google::protobuf::internal::TcParser::AddMessage(google::protobuf::internal::TcParseTableBase const*, google::protobuf::internal::RepeatedPtrFieldBase&)::$_0>(this=0x000000016fdfa790, factory=(unnamed class) @ 0x000000016fdf9e28) at repeated_ptr_field.h:781:27
    frame #7: 0x000000010503ced0 `google::protobuf::internal::TcParser::AddMessage(table=0x000000010ad06bc0, field=0x000000016fdfa790) at generated_message_tctable_lite.cc:521:42
    frame #8: 0x00000001050433d4 `google::protobuf::internal::TcParser::FastMtR1(google::protobuf::MessageLite*, char const*, google::protobuf::internal::ParseContext*, google::protobuf::internal::TcFieldData, google::protobuf::internal::TcParseTableBase const*, unsigned long long) [inlined] char const* google::protobuf::internal::TcParser::RepeatedParseMessageAuxImpl<unsigned char, false, true>(msg=0x000000016fdfa778, ptr="\U00000004\U00000010\U000000012", ctx=0x000000016fdfa408, data=TcFieldData @ 0x000000016fdfa080, table=0x000000010acfaca8, hasbits=1) at generated_message_tctable_lite.cc:621:27
    frame #9: 0x00000001050432e8 `google::protobuf::internal::TcParser::FastMtR1(msg=0x000000016fdfa778, ptr="\U0000001a\U00000004\U00000010\U000000012", ctx=0x000000016fdfa408, data=TcFieldData @ 0x000000016fdf9ff0, table=0x000000010acfaca8, hasbits=1) at generated_message_tctable_lite.cc:660:28
    frame #10: 0x00000001050e9ae0 `bool google::protobuf::internal::MergeFromImpl<false>(google::protobuf::io::ZeroCopyInputStream*, google::protobuf::MessageLite*, google::protobuf::internal::TcParseTableBase const*, google::protobuf::MessageLite::ParseFlags) [inlined] google::protobuf::internal::TcParser::TagDispatch(msg=0x000000016fdfa778, ptr="\U00000012\bE.Guitar\U0000001a\U00000004\U00000010\U000000012", ctx=0x000000016fdfa408, (null)=TcFieldData @ 0x000000016fdfa400, table=0x000000010acfaca8, hasbits=0) at generated_message_tctable_impl.h:1097:28
    frame #11: 0x00000001050e9a28 `bool google::protobuf::internal::MergeFromImpl<false>(google::protobuf::io::ZeroCopyInputStream*, google::protobuf::MessageLite*, google::protobuf::internal::TcParseTableBase const*, google::protobuf::MessageLite::ParseFlags) [inlined] google::protobuf::internal::TcParser::ParseLoop(msg=0x000000016fdfa778, ptr="\U00000012\bE.Guitar\U0000001a\U00000004\U00000010\U000000012", ctx=0x000000016fdfa408, table=0x000000010acface0) at generated_message_tctable_impl.h:1139:11
    frame #12: 0x00000001050e99ac `bool google::protobuf::internal::MergeFromImpl<false>(input=0x000000016fdfa5b0, msg=0x000000016fdfa778, tc_table=0x000000010acfaca8, parse_flags=kParsePartial) at message_lite.cc:243:9
    frame #13: 0x00000001050ec598 `bool google::protobuf::MessageLite::ParseFrom<(google::protobuf::MessageLite::ParseFlags)3, google::protobuf::io::ZeroCopyInputStream*>(this=0x000000016fdfa778, input=0x000000016fdfa560) at message_lite.h:1213:10
    frame #14: 0x00000001050ec370 `google::protobuf::MessageLite::ParsePartialFromZeroCopyStream(this=0x000000016fdfa778, input=0x000000016fdfa5b0) at message_lite.cc:367:10
    frame #15: 0x00000001050ec850 `google::protobuf::MessageLite::ParsePartialFromIstream(this=0x000000016fdfa778, input=0x000000016fdfa908) at message_lite.cc:387:10

All works if both the library and the app are build with the same compiler

[sbenzaquen]

Did you verify that as_tag is kFunc?
Maybe the problem is that kMustBeFunc is true on that TU, but false in others.
We might need to remove that fast override because it might be an issue with mixed compilations.
Can you test if it works by removing kMustBeFunc || ?