Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

heap-buffer-overflow at json_value_parse #7

Closed
NotmebutWind opened this issue Jan 3, 2023 · 4 comments
Closed

heap-buffer-overflow at json_value_parse #7

NotmebutWind opened this issue Jan 3, 2023 · 4 comments

Comments

@NotmebutWind
Copy link

CC=gcc -fsanitize=address make
test.c:
char* jstr = "{ "";
json_value_t *val = json_value_parse(jstr);

use json_value_parse to parse input "{ "" will cause a heap-buffer-overflow error.

==2352670==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000109953 at pc 0x55900a20cc38 bp 0x7ffd112d2dc0 sp 0x7ffd112d2db0
READ of size 1 at 0x602000109953 thread T0
#0 0x55900a20cc37 in json_value_parse /opt1/software/json-parser/json_parser.c:685
#1 0x55900a213a4f in main /opt1/software/json-parser/test.c:184

@Barenboim
Copy link
Owner

Thank you. It's a very stupid mistake…… I fixed it in the latest commit: 2b2b689

@liu-yichen-github
Copy link

Can you tell me an example of triggering this error?

@Barenboim
Copy link
Owner

Barenboim commented Apr 1, 2023

The bug has be fixed. Code that triggers the error in the previous version:

void main()
{
    const char *text = "{\"";
    json_value_t *value = json_value_parse(text);
}

@liu-yichen-github
Copy link

Okay, thank you. I understand your point and I have reproduced the problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants