The following issues were found

src/google/protobuf/compiler/importer_unittest.cc
2 issues
syntax error
Error

Line: 134 

                Importer importer_;
};

TEST_F(ImporterTest, Import) {
  // Test normal importing.
  AddFile("foo.proto",
          "syntax = \"proto2\";\n"
          "message Foo {}\n");

Reported by Cppcheck.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 106 Column: 49 CWE codes: 126 

                  if (contents == NULL) {
      return NULL;
    } else {
      return new io::ArrayInputStream(contents, strlen(contents));
    }
  }

  std::string GetLastErrorMessage() { return "File not found."; }

Reported by FlawFinder.

src/google/protobuf/compiler/java/java_context.cc
2 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 162 Column: 20 CWE codes: 120 

                  // For fields conflicting with some other fields, we append the field
    // number to their field names in generated code to avoid conflicts.
    if (is_conflict[i]) {
      info.name += StrCat(field->number());
      info.capitalized_name += StrCat(field->number());
      info.disambiguated_reason = conflict_reason[i];
    }
    field_generator_info_map_[field] = info;
  }

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 163 Column: 32 CWE codes: 120 

                  // number to their field names in generated code to avoid conflicts.
    if (is_conflict[i]) {
      info.name += StrCat(field->number());
      info.capitalized_name += StrCat(field->number());
      info.disambiguated_reason = conflict_reason[i];
    }
    field_generator_info_map_[field] = info;
  }
}

Reported by FlawFinder.

src/google/protobuf/compiler/java/java_string_field.cc
2 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 76 Column: 7 CWE codes: 120 

                    "= " + ImmutableDefaultValue(descriptor, name_resolver);
  (*variables)["capitalized_type"] = "String";
  (*variables)["tag"] =
      StrCat(static_cast<int32_t>(WireFormat::MakeTag(descriptor)));
  (*variables)["tag_size"] = StrCat(
      WireFormat::TagSize(descriptor->number(), GetType(descriptor)));
  (*variables)["null_check"] =
      "  if (value == null) {\n"
      "    throw new NullPointerException();\n"

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 77 Column: 30 CWE codes: 120 

                (*variables)["capitalized_type"] = "String";
  (*variables)["tag"] =
      StrCat(static_cast<int32_t>(WireFormat::MakeTag(descriptor)));
  (*variables)["tag_size"] = StrCat(
      WireFormat::TagSize(descriptor->number(), GetType(descriptor)));
  (*variables)["null_check"] =
      "  if (value == null) {\n"
      "    throw new NullPointerException();\n"
      "  }\n";

Reported by FlawFinder.

src/google/protobuf/compiler/java/java_string_field_lite.cc
2 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 77 Column: 7 CWE codes: 120 

                    "= " + ImmutableDefaultValue(descriptor, name_resolver);
  (*variables)["capitalized_type"] = "java.lang.String";
  (*variables)["tag"] =
      StrCat(static_cast<int32_t>(WireFormat::MakeTag(descriptor)));
  (*variables)["tag_size"] = StrCat(
      WireFormat::TagSize(descriptor->number(), GetType(descriptor)));
  // We use `x.getClass()` as a null check because it generates less bytecode
  // than an `if (x == null) { throw ... }` statement.
  (*variables)["null_check"] =

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 78 Column: 30 CWE codes: 120 

                (*variables)["capitalized_type"] = "java.lang.String";
  (*variables)["tag"] =
      StrCat(static_cast<int32_t>(WireFormat::MakeTag(descriptor)));
  (*variables)["tag_size"] = StrCat(
      WireFormat::TagSize(descriptor->number(), GetType(descriptor)));
  // We use `x.getClass()` as a null check because it generates less bytecode
  // than an `if (x == null) { throw ... }` statement.
  (*variables)["null_check"] =
      "  java.lang.Class<?> valueClass = value.getClass();\n";

Reported by FlawFinder.

src/google/protobuf/compiler/parser.cc
2 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1284 Column: 29 CWE codes: 120 

                    DO(ConsumeInteger64(max_value, &value,
                          "Expected integer for field default value."));
      // And stringify it again.
      default_value->append(StrCat(value));
      break;
    }

    case FieldDescriptorProto::TYPE_UINT32:
    case FieldDescriptorProto::TYPE_UINT64:

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1307 Column: 29 CWE codes: 120 

                    DO(ConsumeInteger64(max_value, &value,
                          "Expected integer for field default value."));
      // And stringify it again.
      default_value->append(StrCat(value));
      break;
    }

    case FieldDescriptorProto::TYPE_FLOAT:
    case FieldDescriptorProto::TYPE_DOUBLE:

Reported by FlawFinder.

src/google/protobuf/compiler/parser_unittest.cc
2 issues
syntax error
Error

Line: 191 

              
// ===================================================================

TEST_F(ParserTest, StopAfterSyntaxIdentifier) {
  SetupParser(
      "// blah\n"
      "syntax = \"foobar\";\n"
      "this line will not be parsed\n");
  parser_->SetStopAfterSyntaxIdentifier(true);

Reported by Cppcheck.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 112 Column: 53 CWE codes: 126 

              
  // Set up the parser to parse the given text.
  void SetupParser(const char* text) {
    raw_input_.reset(new io::ArrayInputStream(text, strlen(text)));
    input_.reset(new io::Tokenizer(raw_input_.get(), &error_collector_));
    parser_.reset(new Parser());
    parser_->RecordErrorsTo(&error_collector_);
    parser_->SetRequireSyntaxIdentifier(require_syntax_identifier_);
  }

Reported by FlawFinder.

src/google/protobuf/compiler/plugin.pb.cc
2 issues
There is an unknown macro here somewhere. Configuration is required. If PROTOBUF_NAMESPACE_OPEN is a macro then please configure it.
Error

Line: 1531 

              // @@protoc_insertion_point(namespace_scope)
}  // namespace compiler
PROTOBUF_NAMESPACE_CLOSE
PROTOBUF_NAMESPACE_OPEN
template<> PROTOBUF_NOINLINE ::PROTOBUF_NAMESPACE_ID::compiler::Version* Arena::CreateMaybeMessage< ::PROTOBUF_NAMESPACE_ID::compiler::Version >(Arena* arena) {
  return Arena::CreateMessageInternal< ::PROTOBUF_NAMESPACE_ID::compiler::Version >(arena);
}
template<> PROTOBUF_NOINLINE ::PROTOBUF_NAMESPACE_ID::compiler::CodeGeneratorRequest* Arena::CreateMaybeMessage< ::PROTOBUF_NAMESPACE_ID::compiler::CodeGeneratorRequest >(Arena* arena) {
  return Arena::CreateMessageInternal< ::PROTOBUF_NAMESPACE_ID::compiler::CodeGeneratorRequest >(arena);

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 255 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

                  suffix_.Set(::PROTOBUF_NAMESPACE_ID::internal::ArenaStringPtr::EmptyDefault{}, from._internal_suffix(), 
      GetArenaForAllocation());
  }
  ::memcpy(&major_, &from.major_,
    static_cast<size_t>(reinterpret_cast<char*>(&patch_) -
    reinterpret_cast<char*>(&major_)) + sizeof(patch_));
  // @@protoc_insertion_point(copy_constructor:google.protobuf.compiler.Version)
}

Reported by FlawFinder.

src/google/protobuf/descriptor_database_unittest.cc
2 issues
syntax error
Error

Line: 178 

                DescriptorDatabase* database_;
};

TEST_P(DescriptorDatabaseTest, FindFileByName) {
  AddToDatabase(
      "name: \"foo.proto\" "
      "message_type { name:\"Foo\" }");
  AddToDatabase(
      "name: \"bar.proto\" "

Reported by Cppcheck.

syntax error
Error

Line: 486 

              
#endif  // GTEST_HAS_PARAM_TEST

TEST(EncodedDescriptorDatabaseExtraTest, FindNameOfFileContainingSymbol) {
  // Create two files, one of which is in two parts.
  FileDescriptorProto file1, file2a, file2b;
  file1.set_name("foo.proto");
  file1.set_package("foo");
  file1.add_message_type()->set_name("Foo");

Reported by Cppcheck.

src/google/protobuf/duration.pb.cc
2 issues
There is an unknown macro here somewhere. Configuration is required. If PROTOBUF_NAMESPACE_OPEN is a macro then please configure it.
Error

Line: 293 

              
// @@protoc_insertion_point(namespace_scope)
PROTOBUF_NAMESPACE_CLOSE
PROTOBUF_NAMESPACE_OPEN
template<> PROTOBUF_NOINLINE ::PROTOBUF_NAMESPACE_ID::Duration* Arena::CreateMaybeMessage< ::PROTOBUF_NAMESPACE_ID::Duration >(Arena* arena) {
  return Arena::CreateMessageInternal< ::PROTOBUF_NAMESPACE_ID::Duration >(arena);
}
PROTOBUF_NAMESPACE_CLOSE

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 97 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data 

              Duration::Duration(const Duration& from)
  : ::PROTOBUF_NAMESPACE_ID::Message() {
  _internal_metadata_.MergeFrom<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>(from._internal_metadata_);
  ::memcpy(&seconds_, &from.seconds_,
    static_cast<size_t>(reinterpret_cast<char*>(&nanos_) -
    reinterpret_cast<char*>(&seconds_)) + sizeof(nanos_));
  // @@protoc_insertion_point(copy_constructor:google.protobuf.Duration)
}

Reported by FlawFinder.

src/google/protobuf/repeated_field_reflection_unittest.cc
2 issues
syntax error
Error

Line: 57 

              
static std::string StrFunc(int i, int j) { return StrCat(Func(i, 4)); }

TEST(RepeatedFieldReflectionTest, RegularFields) {
  TestAllTypes message;
  const Reflection* refl = message.GetReflection();
  const Descriptor* desc = message.GetDescriptor();

  for (int i = 0; i < 10; ++i) {

Reported by Cppcheck.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 55 Column: 51 CWE codes: 120 

              
static int Func(int i, int j) { return i * j; }

static std::string StrFunc(int i, int j) { return StrCat(Func(i, 4)); }

TEST(RepeatedFieldReflectionTest, RegularFields) {
  TestAllTypes message;
  const Reflection* refl = message.GetReflection();
  const Descriptor* desc = message.GetDescriptor();

Reported by FlawFinder.