mirror/json-c
1
0
Fork 0
mirror of https://github.com/json-c/json-c.git synced 2026-04-04 12:59:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #664 from stoeckmann/string

Browse Source 
Limit strings at INT_MAX length
This commit is contained in:
Eric Hawicz
2020-08-23 16:43:31 -04:00
committed by GitHub
parent f941931804 e50154f615
commit b4e72c2655
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
json_object.c
View File

@@ -214,7 +214,7 @@ static inline const char *get_string_component(const struct json_object *jso)
static int json_escape_str(struct printbuf *pb, const char *str, size_t len, int flags) static int json_escape_str(struct printbuf *pb, const char *str, size_t len, int flags)
{ {
int pos = 0, start_offset = 0; size_t pos = 0, start_offset = 0;
unsigned char c; unsigned char c;
while (len--) while (len--)
{ {
@@ -1254,17 +1254,17 @@ static struct json_object *_json_object_new_string(const char *s, const size_t l
struct json_object_string *jso; struct json_object_string *jso;
/* /*
* Structures Actual memory layout * Structures Actual memory layout
* ------------------- -------------------- * ------------------- --------------------
* [json_object_string [json_object_string * [json_object_string [json_object_string
* [json_object] [json_object] * [json_object] [json_object]
* ...other fields... ...other fields... * ...other fields... ...other fields...
* c_string] len * c_string] len
* bytes * bytes
* of * of
* string * string
* data * data
* \0] * \0]
*/ */
if (len > (SSIZE_T_MAX - (sizeof(*jso) - sizeof(jso->c_string)) - 1)) if (len > (SSIZE_T_MAX - (sizeof(*jso) - sizeof(jso->c_string)) - 1))
return NULL; return NULL;
@@ -1329,9 +1329,10 @@ static int _json_object_set_string_len(json_object *jso, const char *s, size_t l
if (jso == NULL || jso->o_type != json_type_string) if (jso == NULL || jso->o_type != json_type_string)
return 0; return 0;
if (len >= SSIZE_T_MAX - 1) if (len >= INT_MAX - 1)
// jso->len is a signed ssize_t, so it can't hold the // jso->len is a signed ssize_t, so it can't hold the
// full size_t range. // full size_t range. json_object_get_string_len returns
// length as int, cap length at INT_MAX.
return 0; return 0;
dstbuf = get_string_component_mutable(jso); dstbuf = get_string_component_mutable(jso);