Add field ownership check to SwapFields to prevent OOB memory access

[jortles]

Summary

Reflection::SwapFieldsImpl() validates that both messages belong to the correct Reflection object (GetReflection() == this), but does not verify that each field descriptor in the fields vector belongs to the message's own descriptor. This means a field from a different message type can be passed in, and its index() value can exceed the bounds of the target descriptor's offsets_ array.

When this happens, GetFieldOffset() at generated_message_reflection.h:127 reads offsets_[field->index()] out of bounds, producing an arbitrary offset value. The subsequent std::swap then writes 8 bytes at that offset relative to the message pointer, corrupting adjacent heap memory.

Root cause

Every other Reflection write method (SetInt32, SetString, HasField, ClearField, Swap, RemoveLast, MutableRawRepeatedField, etc.) includes USAGE_CHECK_MESSAGE_TYPE which validates field->containing_type() == descriptor_. The SwapFieldsImpl path was the only write method missing this check.

Fix

Add ABSL_CHECK_EQ(field->containing_type(), descriptor_) for each field at the top of the loop in SwapFieldsImpl, before any field operations. This matches the validation pattern used by all other Reflection methods.

Impact

Without this check, passing a foreign field descriptor causes:

• Out-of-bounds read on offsets_[] array (reads heap data as a field offset)
• Out-of-bounds write via std::swap at the corrupted offset (overwrites adjacent heap objects)

Test plan

• Added SwapFieldsForeignFieldCheck death test: passes a ForeignMessage field to SwapFields on a TestAllTypes message, verifies the check fires with "does not belong to message type"
• Follows the same pattern as the existing UsageErrors death test
• All existing SwapFields* tests should pass unchanged (they only use fields from the correct descriptor)