mirror/json-c
1
0
Fork 0
mirror of https://github.com/json-c/json-c.git synced 2026-03-25 07:59:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Issue #275: fix out of bounds read when handling unicode surrogate pairs.

Browse Source
This commit is contained in:
Eric Haszlakiewicz
2016-10-05 23:15:51 -04:00
parent 5fd99e62ed
commit 36a28fcb0c
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
json_tokener.c
View File

@@ -580,7 +580,7 @@ struct json_object* json_tokener_parse_ex(struct json_tokener *tok,
/* Handle a 4-byte sequence, or two sequences if a surrogate pair */
while(1) {
if(strchr(json_hex_chars, c)) {
if (c && strchr(json_hex_chars, c)) {
tok->ucs_char += ((unsigned int)jt_hexdigit(c) << ((3-tok->st_pos++)*4));
if(tok->st_pos == 4) {
unsigned char unescaped_utf[4];
@@ -611,8 +611,8 @@ struct json_object* json_tokener_parse_ex(struct json_tokener *tok,
*/
got_hi_surrogate = tok->ucs_char;
/* Not at end, and the next two chars should be "\u" */
if ((tok->char_offset+1 != len) &&
(tok->char_offset+2 != len) &&
if ((len == -1 || len > (tok->char_offset + 2)) &&
// str[0] != '0' && // implied by json_hex_chars, above.
(str[1] == '\\') &&
(str[2] == 'u'))
{

5
tests/test_parse.c
View File

@@ -44,6 +44,11 @@ static void test_basic_parse()
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj);
// Test with a "short" high surrogate
new_obj = json_tokener_parse("[9,'\\uDAD");
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj);
new_obj = json_tokener_parse("null");
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj);

1
tests/test_parse.expected
View File

@@ -3,6 +3,7 @@ new_obj.to_string()="foo"
new_obj.to_string()="foo"
new_obj.to_string()="ABC"
new_obj.to_string()=null
new_obj.to_string()=null
new_obj.to_string()=NaN
new_obj.to_string()=null
new_obj.to_string()=null