Fix: Check flatbuffer integrity before parsing

[AustinBenoit]

Description

Provide details of the change, and generalize the change in the PR title above.
Fix: Check flatbuffer integrity before parsing
Updated flatbuffer to latest version to get verify buffer Use strol for key parsing to ensure exceptions do not result in a crash.

---

Testing

Describe how you've tested these changes. Link any manually triggered Integration tests or CPP binary SDK Packaging Github Action workflows, if applicable.

Integration test in github

---

Type of Change

Place an x the applicable box:

• Bug fix. Add the issue # below if applicable.
• New feature. A non-breaking change which adds functionality.
• Other, such as a build process or documentation change.

---

Notes

• Bug fixes and feature changes require an update to the Release Notes section of release_build_files/readme.md.
• Read the contribution guidelines CONTRIBUTING.md.
• Changes to the public API require an internal API review. If you'd like to help us make Firebase APIs better, please propose your change in a feature request so that we can discuss it together.

[gemini-code-assist]

Code Review

This pull request updates the Flatbuffers dependency to a newer version, removes an obsolete patch file, and improves the robustness of the Remote Config desktop implementation. Specifically, it adds buffer verification before deserializing flexbuffers, enhances file path handling and error checking in the file manager, and replaces std::stoi with safer string-to-integer parsing in the metadata deserialization. The review feedback highlights critical improvements: ensuring robust overflow detection for std::strtol on LLP64 platforms (like Windows) by checking errno, preventing potential undefined behavior from a null package_name(), and explicitly including the necessary and headers.

[github-actions]

❌  Integration test FAILED

Requested by @AustinBenoit on commit 818d66e
Last updated: Wed Jun 24 14:12 PDT 2026
View integration test log & download artifacts

Failures	Configs
analytics	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/4 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT
app_check	[TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT
auth	[TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/4 android_device: android_target] (1 failed tests)   FirebaseAuthTest.TestLinkAnonymousUserWithEmailCredential
firestore	(4 items) [TEST] [ERROR] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_target] [TEST] [FAILURE] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_target] (1 failed tests)   WriteBatchTest.TestCanWriteTheSameDocumentMultipleTimes [TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/4 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT [TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_latest] (1 failed tests)   AggregateCountTest.TestCanQueryByDocumentId
functions	[TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT
messaging	[TEST] [FLAKINESS] [Android] [1/3 os: windows] [1/4 android_device: android_target] (1 failed tests)   CRASH/TIMEOUT
remote_config	[TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/4 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT

Add flaky tests to go/fpl-cpp-flake-tracker

[AustinBenoit]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates Flatbuffers to support buffer verification, adds integrity checks to prevent crashes on invalid data, and improves path resolution and error handling in Remote Config. The reviewer feedback highlights a critical bug where a boolean return value is incorrectly compared to nullptr, an issue with an unintended leading slash when the package name is empty, and suggests using default cases instead of case flexbuffers::FBT_MAX_TYPE to robustly handle corrupted or unknown flexbuffer types.

[AustinBenoit]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates Flatbuffers to a newer version, introduces buffer verification checks before deserializing flexbuffers, and hardens Remote Config desktop code with robust error and bounds checking. Feedback on the changes includes addressing a potential absolute path issue when package_name is empty or null, and adding a null pointer check for the configs parameter in RemoteConfigFileManager::Load to prevent crashes.

[wiz-9635d3485b]

Wiz Scan Summary

⚠️ Many findings detected

Many findings were detected, but only a subset of the findings are displayed inline due to API constraints. To view all findings inline, please click here.

Scanner	Findings
Vulnerabilities	25  37  3
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	25  37  3

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.