octoleo
/
qpdf
mirror of https://github.com/qpdf/qpdf.git
2
1
Fork 0
Code Issues Releases Wiki Activity

Detect end of input inside an unfinished JSON string

This commit is contained in:
Jay Berkenbilt 2024-02-06 15:30:29 -05:00
parent 3490090fbc
commit b1b789df42
4 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fuzz/json_fuzzer_seed_corpus/9bc1baa450a0977fb3ac06c1ddb3fc2d4c05a5ce Normal file
View File

@ -0,0 +1 @@
{"qpdf":[{},{"obj:1 0 R":{"stream":{"data":"

2
fuzz/qtest/fuzz.test
View File

@ -16,7 +16,7 @@ my @fuzzers = (
['dct' => 1], ['dct' => 1],
['flate' => 1], ['flate' => 1],
['hex' => 1], ['hex' => 1],
['json' => 39], ['json' => 40],
['lzw' => 2], ['lzw' => 2],
['pngpredictor' => 1], ['pngpredictor' => 1],
['runlength' => 6], ['runlength' => 6],

5
libqpdf/JSON.cc
View File

@ -628,6 +628,7 @@ namespace
ls_number_e_sign, ls_number_e_sign,
ls_alpha, ls_alpha,
ls_string, ls_string,
ls_after_string,
ls_backslash, ls_backslash,
ls_u4, ls_u4,
ls_begin_array, ls_begin_array,
@ -1039,7 +1040,7 @@ JSONParser::getToken()
"JSON: offset " + std::to_string(high_offset) + "JSON: offset " + std::to_string(high_offset) +
": UTF-16 high surrogate not followed by low surrogate"); ": UTF-16 high surrogate not followed by low surrogate");
} }
ignore(); ignore(ls_after_string);
return; return;
} else if (*p == '\\') { } else if (*p == '\\') {
ignore(ls_backslash); ignore(ls_backslash);
@ -1234,7 +1235,7 @@ JSONParser::handleToken()
} }
break; break;
case ls_string: case ls_after_string:
if (parser_state == ps_dict_begin || parser_state == ps_dict_after_comma) { if (parser_state == ps_dict_begin || parser_state == ps_dict_after_comma) {
dict_key = token; dict_key = token;
dict_key_offset = token_start; dict_key_offset = token_start;

6
libtests/json.cc
View File

@ -134,6 +134,12 @@ test_main()
" \"normal\": \"string\"\n" " \"normal\": \"string\"\n"
"}"); "}");
try {
JSON::parse("\"");
assert(false);
} catch (std::runtime_error&) {
}
// Check default constructed JSON object (order as per JSON.hh). // Check default constructed JSON object (order as per JSON.hh).
JSON uninitialized; JSON uninitialized;
std::string ws; std::string ws;