DaveGamble/cJSON
1
0
Fork 0
mirror of https://github.com/DaveGamble/cJSON.git synced 2026-06-06 05:14:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

allocate memory for the temporary buffer

Browse Source 
Allocate memory for the temporary buffer when paring numbers.
This fixes CVE-2023-26819
This commit is contained in:
PeterAlfredLee
2025-04-21 15:18:10 +08:00
committed by Alan Wang
parent 12c4bf1986
commit a328d65ad4
3 changed files with 69 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/misc_tests.c
+17
View File
@@ -782,6 +782,22 @@ static void cjson_set_bool_value_must_not_break_objects(void)
cJSON_Delete(sobj);
}
static void cjson_parse_big_numbers_should_not_report_error(void)
{
cJSON *valid_big_number_json_object1 = cJSON_Parse("{\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}");
cJSON *valid_big_number_json_object2 = cJSON_Parse("{\"a\": true, \"b\": [ null,999999999999999999999999999999999999999999999991234567890.1234567E3]}");
const char *invalid_big_number_json1 = "{\"a\": true, \"b\": [ null,99999999999999999999999999999999999999999999999.1234567890.1234567]}";
const char *invalid_big_number_json2 = "{\"a\": true, \"b\": [ null,99999999999999999999999999999999999999999999999E1234567890e1234567]}";
TEST_ASSERT_NOT_NULL(valid_big_number_json_object1);
TEST_ASSERT_NOT_NULL(valid_big_number_json_object2);
TEST_ASSERT_NULL_MESSAGE(cJSON_Parse(invalid_big_number_json1), "Invalid big number JSONs should not be parsed.");
TEST_ASSERT_NULL_MESSAGE(cJSON_Parse(invalid_big_number_json2), "Invalid big number JSONs should not be parsed.");
cJSON_Delete(valid_big_number_json_object1);
cJSON_Delete(valid_big_number_json_object2);
}
int CJSON_CDECL main(void)
{
UNITY_BEGIN();
@@ -815,6 +831,7 @@ int CJSON_CDECL main(void)
RUN_TEST(cjson_delete_item_from_array_should_not_broken_list_structure);
RUN_TEST(cjson_set_valuestring_to_object_should_not_leak_memory);
RUN_TEST(cjson_set_bool_value_must_not_break_objects);
RUN_TEST(cjson_parse_big_numbers_should_not_report_error);
return UNITY_END();
}
tests/parse_number.c
+20
View File
@@ -48,6 +48,7 @@ static void assert_parse_number(const char *string, int integer, double real)
parse_buffer buffer = { 0, 0, 0, 0, { 0, 0, 0 } };
buffer.content = (const unsigned char*)string;
buffer.length = strlen(string) + sizeof("");
buffer.hooks = global_hooks;
TEST_ASSERT_TRUE(parse_number(item, &buffer));
assert_is_number(item);
@@ -55,6 +56,17 @@ static void assert_parse_number(const char *string, int integer, double real)
TEST_ASSERT_EQUAL_DOUBLE(real, item->valuedouble);
}
static void assert_parse_big_number(const char *string)
{
parse_buffer buffer = { 0, 0, 0, 0, { 0, 0, 0 } };
buffer.content = (const unsigned char*)string;
buffer.length = strlen(string) + sizeof("");
buffer.hooks = global_hooks;
TEST_ASSERT_TRUE(parse_number(item, &buffer));
assert_is_number(item);
}
static void parse_number_should_parse_zero(void)
{
assert_parse_number("0", 0, 0);
@@ -96,6 +108,13 @@ static void parse_number_should_parse_negative_reals(void)
assert_parse_number("-123e-128", 0, -123e-128);
}
static void parse_number_should_parse_big_numbers(void)
{
assert_parse_big_number("9999999999999999999999999999999999999999999999912345678901234567");
assert_parse_big_number("9999999999999999999999999999999999999999999999912345678901234567E10");
assert_parse_big_number("999999999999999999999999999999999999999999999991234567890.1234567");
}
int CJSON_CDECL main(void)
{
/* initialize cJSON item */
@@ -106,5 +125,6 @@ int CJSON_CDECL main(void)
RUN_TEST(parse_number_should_parse_positive_integers);
RUN_TEST(parse_number_should_parse_positive_reals);
RUN_TEST(parse_number_should_parse_negative_reals);
RUN_TEST(parse_number_should_parse_big_numbers);
return UNITY_END();
}