mirrors/pulseaudio
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pulseaudio/pulseaudio.git synced 2025-11-04 13:29:59 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

json: Add overflow checks for integer and float parsing

Browse source 
Signed-off-by: Arun Raghavan <arun@arunraghavan.net>
This commit is contained in:
Arun Raghavan 2016-06-01 17:18:34 +05:30
parent 708b4aac91
commit 777a5091f6
2 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/pulse/json.c
View file

@ -211,6 +211,11 @@ static const char* parse_number(const char *str, pa_json_object *obj) {
} }
while (is_digit(*str)) { while (is_digit(*str)) {
if (integer > ((negative ? INT_MAX : UINT_MAX) / 10)) {
pa_log("Integer overflow while parsing number");
goto error;
}
integer = (integer * 10) + (*str - '0'); integer = (integer * 10) + (*str - '0');
str++; str++;
} }
@ -221,6 +226,11 @@ fraction:
str++; str++;
while (is_digit(*str)) { while (is_digit(*str)) {
if (fraction > (UINT_MAX / 10)) {
pa_log("Integer overflow while parsing fractional part of number");
goto error;
}
fraction = (fraction * 10) + (*str - '0'); fraction = (fraction * 10) + (*str - '0');
fraction_digits++; fraction_digits++;
str++; str++;
@ -240,6 +250,11 @@ fraction:
str++; str++;
while (is_digit(*str)) { while (is_digit(*str)) {
if (exponent > (INT_MAX / 10)) {
pa_log("Integer overflow while parsing exponent part of number");
goto error;
}
exponent = (exponent * 10) + (*str - '0'); exponent = (exponent * 10) + (*str - '0');
str++; str++;
} }
@ -258,6 +273,9 @@ fraction:
} }
return str; return str;
error:
return NULL;
} }
static const char *parse_object(const char *str, pa_json_object *obj) { static const char *parse_object(const char *str, pa_json_object *obj) {

3
src/tests/json-test.c
View file

@ -220,6 +220,9 @@ START_TEST(bad_test) {
unsigned int i; unsigned int i;
const char *bad_parse[] = { const char *bad_parse[] = {
"\"" /* Quote not closed */, "\"" /* Quote not closed */,
"123456789012345678901234567890" /* Overflow */,
"0.123456789012345678901234567890" /* Overflow */,
"1e123456789012345678901234567890" /* Overflow */,
}; };
for (i = 0; i < PA_ELEMENTSOF(bad_parse); i++) { for (i = 0; i < PA_ELEMENTSOF(bad_parse); i++) {