commit 0ba088e39c94c171523590c07834539396167539
author aPiecek <piecek@cesnet.cz> Tue Jun 15 12:53:17 2021 +0200
committer Michal Vasko <mvasko@cesnet.cz> Wed Jun 16 08:09:06 2021 +0200
tree 8fecb34b324709ae10d706f91b132ae397e9dee9
parent fc0dc52cc2a42436c10ae091e968ded5460c61b0

json BUGFIX integer under/overflow checks

... in ::lyjson_exp_number().

src/json.c

diff --git a/src/json.c b/src/json.c
index 4613d49..7b23f30 100644
--- a/src/json.c
+++ b/src/json.c
@@ -390,7 +390,7 @@
  * @return LY_ERR value.
  */
 static LY_ERR
-lyjson_get_buffer_for_number(const struct ly_ctx *ctx, uint32_t num_len, char **buffer)
+lyjson_get_buffer_for_number(const struct ly_ctx *ctx, uint64_t num_len, char **buffer)
 {
     *buffer = NULL;
 
@@ -461,7 +461,7 @@
  */
 static LY_ERR
 lyjson_exp_number(const struct ly_ctx *ctx, const char *in, const char *exponent,
-        size_t total_len, char **res, size_t *res_len)
+        uint64_t total_len, char **res, uint64_t *res_len)
 {
 
 #define MAYBE_WRITE_MINUS(ARRAY, INDEX, FLAG) \
@@ -479,7 +479,7 @@
     /* Buffer where the result is stored. */
     char *buf;
     /* Size without space for terminating NULL-byte. */
-    uint32_t buf_len;
+    uint64_t buf_len;
     /* Index to buf. */
     uint32_t i = 0;
     /* A 'numeric part' doesn't contain a minus sign or an leading zero.
@@ -487,7 +487,7 @@
      */
     const char *num;
     /* Length of the 'numeric part' ends before E/e. */
-    uint32_t num_len;
+    uint16_t num_len;
     /* Position of decimal point in the num. */
     char *dec_point;
     /* Final position of decimal point in the buf. */
@@ -506,10 +506,15 @@
     assert(ctx && in && exponent && res && res_len && (total_len > 2));
     assert((in < exponent) && ((*exponent == 'e') || (*exponent == 'E')));
 
+    if ((exponent - in) > UINT16_MAX) {
+        LOGVAL(ctx, LYVE_SEMANTICS, "JSON number is too long.");
+        return LY_EVALID;
+    }
+
     /* Convert exponent. */
     errno = 0;
     e_val = strtol(exponent + 1, NULL, LY_BASE_DEC);
-    if (errno) {
+    if (errno || (labs(e_val) > UINT16_MAX)) {
         LOGVAL(ctx, LYVE_SEMANTICS,
                 "Exponent out-of-bounds in a JSON Number value (%.*s).",
                 total_len, in);

tests/utests/basic/test_json.c

diff --git a/tests/utests/basic/test_json.c b/tests/utests/basic/test_json.c
index b2cfafd..a8d3af4 100644
--- a/tests/utests/basic/test_json.c
+++ b/tests/utests/basic/test_json.c
@@ -505,6 +505,16 @@
     assert_int_equal(LY_EVALID, lyjson_ctx_new(UTEST_LYCTX, in, &jsonctx));
     CHECK_LOG_CTX("Exponent out-of-bounds in a JSON Number value (1e9999999999999999999).", "Line number 1.");
 
+    str = "1.1e66000";
+    assert_non_null(ly_in_memory(in, str));
+    assert_int_equal(LY_EVALID, lyjson_ctx_new(UTEST_LYCTX, in, &jsonctx));
+    CHECK_LOG_CTX("Exponent out-of-bounds in a JSON Number value (1.1e66000).", "Line number 1.");
+
+    str = "1.1e-66000";
+    assert_non_null(ly_in_memory(in, str));
+    assert_int_equal(LY_EVALID, lyjson_ctx_new(UTEST_LYCTX, in, &jsonctx));
+    CHECK_LOG_CTX("Exponent out-of-bounds in a JSON Number value (1.1e-66000).", "Line number 1.");
+
     str = "-2.1e0.";
     assert_non_null(ly_in_memory(in, str));
     assert_int_equal(LY_EVALID, lyjson_ctx_new(UTEST_LYCTX, in, &jsonctx));