Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 8.0.1602: crash in parsing JSON
Problem:    Crash in parsing JSON.
Solution:   Fail when using array or dict as dict key. (Damien)
  • Loading branch information
brammool committed Mar 13, 2018
1 parent ff1e879 commit 625f0c1
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 1 deletion.
14 changes: 13 additions & 1 deletion src/json.c
Expand Up @@ -621,7 +621,9 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
if (top_item != NULL && top_item->jd_type == JSON_OBJECT_KEY
&& (options & JSON_JS)
&& reader->js_buf[reader->js_used] != '"'
&& reader->js_buf[reader->js_used] != '\'')
&& reader->js_buf[reader->js_used] != '\''
&& reader->js_buf[reader->js_used] != '['
&& reader->js_buf[reader->js_used] != '{')
{
char_u *key;

Expand All @@ -642,6 +644,11 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
switch (*p)
{
case '[': /* start of array */
if (top_item && top_item->jd_type == JSON_OBJECT_KEY)
{
retval = FAIL;
break;
}
if (ga_grow(&stack, 1) == FAIL)
{
retval = FAIL;
Expand All @@ -668,6 +675,11 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
continue;

case '{': /* start of object */
if (top_item && top_item->jd_type == JSON_OBJECT_KEY)
{
retval = FAIL;
break;
}
if (ga_grow(&stack, 1) == FAIL)
{
retval = FAIL;
Expand Down
3 changes: 3 additions & 0 deletions src/testdir/test_json.vim
Expand Up @@ -179,6 +179,9 @@ func Test_json_decode()
call assert_fails('call json_decode("[1 2]")', "E474:")

call assert_fails('call json_decode("[1,,2]")', "E474:")

call assert_fails('call json_decode("{{}:42}")', "E474:")
call assert_fails('call json_decode("{[]:42}")', "E474:")
endfunc

let s:jsl5 = '[7,,,]'
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -766,6 +766,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1602,
/**/
1601,
/**/
Expand Down

0 comments on commit 625f0c1

Please sign in to comment.