data BUGFIX check JSON BMP character length
fix OOB read when parsing basic multilingual plane characthers in JSON
data. Previously it was never checked whether there were actually four
characters available after the "\u" sequence, and if there weren't an
OOB read would occur.
add a regression test case, as the issue was found by fuzzing
lyd_parse_mem_json.
diff --git a/src/json.c b/src/json.c
index 56bf734..b95e7df 100644
--- a/src/json.c
+++ b/src/json.c
@@ -219,7 +219,11 @@
/* Basic Multilingual Plane character \uXXXX */
offset++;
for (value = i = 0; i < 4; i++) {
- if (isdigit(in[offset + i])) {
+ if (!in[offset + i]) {
+ LOGVAL(jsonctx->ctx, LY_VLOG_LINE, &jsonctx->line, LYVE_SYNTAX,
+ "Invalid basic multilingual plane character \"%s\".", &in[slash]);
+ goto error;
+ } else if (isdigit(in[offset + i])) {
u = (in[offset + i] - '0');
} else if (in[offset + i] > 'F') {
u = 10 + (in[offset + i] - 'a');
diff --git a/tests/fuzz/corpus/lyd_parse_mem_json/pull1280 b/tests/fuzz/corpus/lyd_parse_mem_json/pull1280
new file mode 100644
index 0000000..0b15336
--- /dev/null
+++ b/tests/fuzz/corpus/lyd_parse_mem_json/pull1280
@@ -0,0 +1 @@
+"\u1
\ No newline at end of file