fix: guard against null struct_def in IsStruct/Deserialize (fixes #9144)

[Ashutosh0x]

Fixes #9144

Problem

StructDef::Deserialize crashes with SEGV when deserializing a bfbs schema that passes VerifySchemaBuffer but has unresolved struct cross-references. IsStruct(), IsIncompleteStruct(), and IsTable() all dereference ype.struct_def without null check.

Root Cause

VerifySchemaBuffer validates FlatBuffer table/vtable structure but not the schema cross-references that Deserialize depends on. A field declared as BASE_TYPE_STRUCT can have a null struct_def, which IsStruct() dereferences unconditionally at idl.h:533:

cpp inline bool IsStruct(const Type& type) { return type.base_type == BASE_TYPE_STRUCT && type.struct_def->fixed; // ^^ NULL DEREF }

The crash path: Parser::Deserialize -> StructDef::Deserialize -> InlineSize -> IsStruct -> SEGV.

Fix

1. Add ype.struct_def != nullptr guard to IsStruct(), IsIncompleteStruct(), and IsTable() in idl.h
2. Add explicit validation in StructDef::Deserialize that rejects fields with unresolved struct references before computing layout (defense-in-depth)
3. Regression test with the exact 134-byte PoC from SEGV in StructDef::Deserialize via IsStruct on a bfbs schema that passes VerifySchemaBuffer #9144

Testing

• Regression test confirms Deserialize returns alse instead of crashing with SEGV
• Existing tests unaffected (null check only triggers on malformed input)

Impact

Any application following the recommended 'verify before use' pattern (VerifySchemaBuffer + Deserialize) is vulnerable to DoS via crafted bfbs schema input.