json BUGFIX out of bounds write in lyjson_number
Count the base number minus in num_len when parsing negative JSON numbers with
an exponent and no decimal point in lyjson_number.
Add a regression test case, as the issue was found by fuzzing
lyd_parse_mem_json.
Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
diff --git a/src/json.c b/src/json.c
index 09b6303..eb1e847 100644
--- a/src/json.c
+++ b/src/json.c
@@ -403,7 +403,7 @@
dp_position = exponent + e_val;
} else {
/* adding decimal point before the integer with adding leading zero(s) */
- num_len = labs(e_val) + 2;
+ num_len = labs(e_val) + 2 + minus;
dp_position = exponent + e_val;
}
dp_position -= minus;