mirror/json-c
1
0
Fork 0
mirror of https://github.com/json-c/json-c.git synced 2026-04-10 07:49:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Issue #275: fix out of bounds read when handling unicode surrogate pairs.

Browse Source
This commit is contained in:
Eric Haszlakiewicz
2016-10-05 23:15:51 -04:00
parent 5fd99e62ed
commit 36a28fcb0c
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
json_tokener.c
View File

@@ -580,7 +580,7 @@ struct json_object* json_tokener_parse_ex(struct json_tokener *tok,
/* Handle a 4-byte sequence, or two sequences if a surrogate pair */ /* Handle a 4-byte sequence, or two sequences if a surrogate pair */
while(1) { while(1) {
if(strchr(json_hex_chars, c)) { if (c && strchr(json_hex_chars, c)) {
tok->ucs_char += ((unsigned int)jt_hexdigit(c) << ((3-tok->st_pos++)*4)); tok->ucs_char += ((unsigned int)jt_hexdigit(c) << ((3-tok->st_pos++)*4));
if(tok->st_pos == 4) { if(tok->st_pos == 4) {
unsigned char unescaped_utf[4]; unsigned char unescaped_utf[4];
@@ -611,8 +611,8 @@ struct json_object* json_tokener_parse_ex(struct json_tokener *tok,
*/ */
got_hi_surrogate = tok->ucs_char; got_hi_surrogate = tok->ucs_char;
/* Not at end, and the next two chars should be "\u" */ /* Not at end, and the next two chars should be "\u" */
if ((tok->char_offset+1 != len) && if ((len == -1 || len > (tok->char_offset + 2)) &&
(tok->char_offset+2 != len) && // str[0] != '0' && // implied by json_hex_chars, above.
(str[1] == '\\') && (str[1] == '\\') &&
(str[2] == 'u')) (str[2] == 'u'))
{ {

5
tests/test_parse.c
View File

@@ -44,6 +44,11 @@ static void test_basic_parse()
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj)); printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj); json_object_put(new_obj);
// Test with a "short" high surrogate
new_obj = json_tokener_parse("[9,'\\uDAD");
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj);
new_obj = json_tokener_parse("null"); new_obj = json_tokener_parse("null");
printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj)); printf("new_obj.to_string()=%s\n", json_object_to_json_string(new_obj));
json_object_put(new_obj); json_object_put(new_obj);

1
tests/test_parse.expected
View File

@@ -3,6 +3,7 @@ new_obj.to_string()="foo"
new_obj.to_string()="foo" new_obj.to_string()="foo"
new_obj.to_string()="ABC" new_obj.to_string()="ABC"
new_obj.to_string()=null new_obj.to_string()=null
new_obj.to_string()=null
new_obj.to_string()=NaN new_obj.to_string()=NaN
new_obj.to_string()=null new_obj.to_string()=null
new_obj.to_string()=null new_obj.to_string()=null