Prevent out of boundary write on malicious input

[stoeckmann]

I have discovered a way to trigger an out of boundary write while parsing a huge json file through a malicious input source. It can be triggered if an attacker has control over the input stream or if a huge load during filesystem operations can be triggered.

Preparation:
$ dd if=/dev/zero of=poc.json bs=1 count=1 seek=2147483647

Code to exploit:

#include <json-c/json_util.h>
#include <unistd.h>
int main() {
  json_object_from_fd(STDIN_FILENO);
  return 0;
}

Proof of Concept:
(dd if=poc.json bs=4096; sleep 1; dd if=test.json bs=10) 2>/dev/null | ./test

Explanation:
The problem manifests itself in printbuf_memappend. On properly crafted values, p->bpos + size + 1 can overflow, which leads to the assumption that p->size is still large enough. In normal circumstances, this does not happen with json_object_from_fd due to its buffer size leading to proper detection. But if the parsed buffer chunk length is not a power of 2 (sleep 1 and bs=10 triggers this in my proof of concept), this overflow can be abused by an attacker to write past the memory boundary of p->buf.

My example simply crashes the program eventually. A proper attack can be controled in a way to not crash the system but simply write a few attacker controlled bytes outside the allocated area, allowing more sophisticated attacks against real world programs.

[coveralls]

Coverage decreased (-0.2%) to 85.768% when pulling d07b910 on stoeckmann:oob into 8e3d3d5 on json-c:master.

[hawicz]

The changes look good, thanks!