mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-29 05:40:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

json: handle overflow better

Browse source 
We need at least the length of the string+1 as the length of the
target in spa_json_get_string(). Add a unit test for this.
This commit is contained in:
Wim Taymans 2021-03-18 19:44:25 +01:00
parent fc9a6d6b1e
commit db85339f50
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
spa/include/spa/utils/json.h
View file

@ -351,7 +351,7 @@ static inline int spa_json_get_string(struct spa_json *iter, char *res, int maxl
{
const char *value;
int len;
if ((len = spa_json_next(iter, &value)) <= 0 || maxlen < len)
if ((len = spa_json_next(iter, &value)) <= 0 || maxlen <= len)
return -1;
return spa_json_parse_string(value, len, res);
}

17
spa/tests/test-json.c
View file

@ -194,11 +194,28 @@ static void test_arrays(void)
test_array("[ FL FR ]", (char *[]){ "FL", "FR", NULL });
}
static void test_overflow(void)
{
struct spa_json it[2];
char val[3];
const char *str = "[ F, FR, FRC ]";
spa_json_init(&it[0], str, strlen(str));
spa_assert(spa_json_enter_array(&it[0], &it[1]) > 0);
spa_assert(spa_json_get_string(&it[1], val, sizeof(val)) > 0);
spa_assert(strcmp(val, "F") == 0);
spa_assert(spa_json_get_string(&it[1], val, sizeof(val)) > 0);
spa_assert(strcmp(val, "FR") == 0);
spa_assert(spa_json_get_string(&it[1], val, sizeof(val)) < 0);
}
int main(int argc, char *argv[])
{
test_abi();
test_parse();
test_encode();
test_arrays();
test_overflow();
return 0;
}