From 40756bc65e1c4093405acbab4c0bee54a168584a Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Mon, 6 May 2024 10:43:42 -0700 Subject: [PATCH] json: fix potential overflow The code: ```cpp while(!EMPTY_STRING(input) && stream.push(*index) != json::reader::REJECTED) { index++; } ``` Runs into an issue because `EMPTY_STRING(input)` is used to check for null-pointer ending, but `input` is never incremented during the loop. As such, an overflow will happen when `index` has incremented beyond it's buffer and `*index` is run. This triggers an overflow on the `input` buffer as `index` is declared as: `const char *index = json::parsing::tlws(input);` Instead of checking for an empty string on `input` we should check it on `index`. Signed-off-by: David Korczynski --- json.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/json.cpp b/json.cpp index 9ae1cb9..647d2e8 100644 --- a/json.cpp +++ b/json.cpp @@ -780,7 +780,7 @@ json::parsing::parse_results json::parsing::parse(const char *input) json::reader stream; // Iterate - while(!EMPTY_STRING(input) && stream.push(*index) != json::reader::REJECTED) + while(!EMPTY_STRING(index) && stream.push(*index) != json::reader::REJECTED) { index++; } @@ -1036,4 +1036,4 @@ std::string json::jobject::pretty(unsigned int indent_level) const result += "}"; } return result; -} \ No newline at end of file +}