json BUGFIX out of bounds write in lyjson_number
Count the base number minus in num_len when parsing negative JSON numbers with
an exponent and no decimal point in lyjson_number.
Add a regression test case, as the issue was found by fuzzing
lyd_parse_mem_json.
Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
diff --git a/src/json.c b/src/json.c
index 09b6303..eb1e847 100644
--- a/src/json.c
+++ b/src/json.c
@@ -403,7 +403,7 @@
dp_position = exponent + e_val;
} else {
/* adding decimal point before the integer with adding leading zero(s) */
- num_len = labs(e_val) + 2;
+ num_len = labs(e_val) + 2 + minus;
dp_position = exponent + e_val;
}
dp_position -= minus;
diff --git a/tests/fuzz/corpus/lyd_parse_mem_json/pull11438 b/tests/fuzz/corpus/lyd_parse_mem_json/pull11438
new file mode 100644
index 0000000..d4722b2
--- /dev/null
+++ b/tests/fuzz/corpus/lyd_parse_mem_json/pull11438
@@ -0,0 +1 @@
+{"0R:0::809e-47,-689e-47,-689e-489e-47":[809e-47,-689e-47,-689e-4709e-47,-689e-47,-689e-489e-47":[809e-47,-689e-47,-689e-47647,-688Je7,-6889e647,-688Je7,-6889e-47"
\ No newline at end of file