1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[flori/json] Fix parser bug for empty string allocation

Browse Source 
When `HAVE_RB_ENC_INTERNED_STR` is enabled it is possible to
pass through a null pointer to `rb_enc_interned_str` resulting
in a segfault

Fixes #495

https://github.com/flori/json/commit/b59368a8c2
This commit is contained in:
Andrew Bromwich 2022-04-20 22:30:35 +10:00 committed by Hiroshi SHIBATA
parent 767f3904ee
commit a15d0e267a
No known key found for this signature in database
GPG Key ID: F9CF13417264FAC2
3 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ext/json/parser/parser.c
View File

@ -2363,9 +2363,17 @@ static VALUE json_string_unescape(char *string, char *stringEnd, int intern, int
char buf[4]; char buf[4];
if (bufferSize > MAX_STACK_BUFFER_SIZE) { if (bufferSize > MAX_STACK_BUFFER_SIZE) {
# ifdef HAVE_RB_ENC_INTERNED_STR
bufferStart = buffer = ALLOC_N(char, bufferSize ? bufferSize : 1);
# else
bufferStart = buffer = ALLOC_N(char, bufferSize); bufferStart = buffer = ALLOC_N(char, bufferSize);
# endif
} else { } else {
# ifdef HAVE_RB_ENC_INTERNED_STR
bufferStart = buffer = ALLOCA_N(char, bufferSize ? bufferSize : 1);
# else
bufferStart = buffer = ALLOCA_N(char, bufferSize); bufferStart = buffer = ALLOCA_N(char, bufferSize);
# endif
} }
while (pe < stringEnd) { while (pe < stringEnd) {

8
ext/json/parser/parser.rl
View File

@ -462,9 +462,17 @@ static VALUE json_string_unescape(char *string, char *stringEnd, int intern, int
char buf[4]; char buf[4];
if (bufferSize > MAX_STACK_BUFFER_SIZE) { if (bufferSize > MAX_STACK_BUFFER_SIZE) {
# ifdef HAVE_RB_ENC_INTERNED_STR
bufferStart = buffer = ALLOC_N(char, bufferSize ? bufferSize : 1);
# else
bufferStart = buffer = ALLOC_N(char, bufferSize); bufferStart = buffer = ALLOC_N(char, bufferSize);
# endif
} else { } else {
# ifdef HAVE_RB_ENC_INTERNED_STR
bufferStart = buffer = ALLOCA_N(char, bufferSize ? bufferSize : 1);
# else
bufferStart = buffer = ALLOCA_N(char, bufferSize); bufferStart = buffer = ALLOCA_N(char, bufferSize);
# endif
} }
while (pe < stringEnd) { while (pe < stringEnd) {

1
test/json/json_parser_test.rb
View File

@ -84,6 +84,7 @@ class JSONParserTest < Test::Unit::TestCase
assert_equal({ "a" => 23 }, parse(' { "a" : 23 } ')) assert_equal({ "a" => 23 }, parse(' { "a" : 23 } '))
assert_equal({ "a" => 0.23 }, parse(' { "a" : 0.23 } ')) assert_equal({ "a" => 0.23 }, parse(' { "a" : 0.23 } '))
assert_equal({ "a" => 0.23 }, parse(' { "a" : 0.23 } ')) assert_equal({ "a" => 0.23 }, parse(' { "a" : 0.23 } '))
assert_equal({ "" => 123 }, parse('{"":123}'))
end end
def test_parse_numbers def test_parse_numbers