fix: Add bounds checks in reflection API to prevent memory corruption

Add bounds checks to prevent out-of-bounds memory access when processing
malformed binary schema (.bfbs) files through the reflection API.

Changes:
- src/reflection.cpp ForAllFields(): Add bounds check before using
  field->id() as array index. field->id() is a uint16_t (range 0-65535)
  but the array is sized to fields()->size(). A malformed schema with
  id >= fields()->size() would cause heap OOB write.

- src/reflection.cpp VerifyObject(): Add minimum offset check for union
  fields before subtraction. field->offset() - sizeof(voffset_t) underflows
  when offset < 2, causing OOB read at offset 0xFFFF/0xFFFE from table pointer.

- src/bfbs_gen.h FieldIdToIndex(): Same bounds check as ForAllFields() -
  both functions have identical vulnerable pattern.

These checks add minimal overhead and protect against malformed schema files
without breaking valid use cases. All existing tests pass.

Author: tufstraka

src/bfbs_gen.h

@@ -72,7 +72,11 @@ static std::vector<uint32_t> FieldIdToIndex(const reflection::Object* object) {
   // Create the mapping of field ID to the index into the vector.
   for (uint32_t i = 0; i < object->fields()->size(); ++i) {
     auto field = object->fields()->Get(i);
-    field_index_by_id[field->id()] = i;
+    // Bounds check: field->id() is a uint16_t from the schema and could
+    // exceed fields()->size() in a malformed schema. Skip invalid IDs.
+    if (field->id() < object->fields()->size()) {
+      field_index_by_id[field->id()] = i;
+    }
   }
 
   return field_index_by_id;

src/reflection.cpp

@@ -250,6 +250,10 @@ static bool VerifyObject(flatbuffers::Verifier& v,
       }
       case reflection::Union: {
         //  get union type from the prev field
+        // Bounds check: offset must be >= sizeof(voffset_t) to avoid underflow
+        if (field_def->offset() < sizeof(voffset_t)) {
+          return false;
+        }
         voffset_t utype_offset = field_def->offset() - sizeof(voffset_t);
         auto utype = table->GetField<uint8_t>(utype_offset, 0);
         auto uval = reinterpret_cast<const uint8_t*>(
@@ -384,7 +388,11 @@ void ForAllFields(const reflection::Object* object, bool reverse,
   // Create the mapping of field ID to the index into the vector.
   for (uint32_t i = 0; i < object->fields()->size(); ++i) {
     auto field = object->fields()->Get(i);
-    field_to_id_map[field->id()] = i;
+    // Bounds check: field->id() is a uint16_t from the schema and could
+    // exceed fields()->size() in a malformed schema. Skip invalid IDs.
+    if (field->id() < object->fields()->size()) {
+      field_to_id_map[field->id()] = i;
+    }
   }
 
   for (size_t i = 0; i < field_to_id_map.size(); ++i) {