NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit6600856

committed

Avoid reading past datum end when parsing JSON.

Several loops in the JSON parser examined a byte in memory just beforechecking whether its address was in-bounds, so they could read one bytebeyond the datum's allocation. A SIGSEGV is possible. New in 9.3, sono back-patch.

1 parent3a5d0c5 commit6600856Copy full SHA for 6600856

File tree

1 file changed

+13

-8

lines changed

src/backend/utils/adt
- json.c

1 file changed

+13

-8

lines changed

`‎src/backend/utils/adt/json.c`

Lines changed: 13 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -598,7 +598,7 @@ json_lex(JsonLexContext *lex)`
`598`	`598`	`* the whole word as an unexpected token, rather than just`
`599`	`599`	`* some unintuitive prefix thereof.`
`600`	`600`	`*/`
`601`		`-for (p=s;JSON_ALPHANUMERIC_CHAR(*p)&&p-s<lex->input_length-len;p++)`
	`601`	`+for (p=s;p-s<lex->input_length-len&&JSON_ALPHANUMERIC_CHAR(*p);p++)`
`602`	`602`	`/* skip */ ;`
`603`	`603`
`604`	`604`	`/*`
`@@ -651,16 +651,21 @@ json_lex_string(JsonLexContext *lex)`
`651`	`651`	`if (lex->strval!=NULL)`
`652`	`652`	`resetStringInfo(lex->strval);`
`653`	`653`
	`654`	`+Assert(lex->input_length>0);`
	`655`	`+s=lex->token_start;`
`654`	`656`	`len=lex->token_start-lex->input;`
`655`		`-len++;`
`656`		`-for (s=lex->token_start+1;*s!='"';s++,len++)`
	`657`	`+for (;;)`
`657`	`658`	`{`
	`659`	`+s++;`
	`660`	`+len++;`
`658`	`661`	`/* Premature end of the string. */`
`659`	`662`	`if (len >=lex->input_length)`
`660`	`663`	`{`
`661`	`664`	`lex->token_terminator=s;`
`662`	`665`	`report_invalid_token(lex);`
`663`	`666`	`}`
	`667`	`+elseif (*s=='"')`
	`668`	`+break;`
`664`	`669`	`elseif ((unsignedchar)*s<32)`
`665`	`670`	`{`
`666`	`671`	`/* Per RFC4627, these characters MUST be escaped. */`
`@@ -921,7 +926,7 @@ json_lex_number(JsonLexContext lex, char s)`
`921`	`926`	`{`
`922`	`927`	`s++;`
`923`	`928`	`len++;`
`924`		`-}while (s >='0'&&s <='9'&&len<lex->input_length);`
	`929`	`+}while (len<lex->input_length&&s >='0'&&s <='9');`
`925`	`930`	`}`
`926`	`931`	`else`
`927`	`932`	`error= true;`
`@@ -939,7 +944,7 @@ json_lex_number(JsonLexContext lex, char s)`
`939`	`944`	`{`
`940`	`945`	`s++;`
`941`	`946`	`len++;`
`942`		`-}while (s >='0'&&s <='9'&&len<lex->input_length);`
	`947`	`+}while (len<lex->input_length&&s >='0'&&s <='9');`
`943`	`948`	`}`
`944`	`949`	`}`
`945`	`950`
`@@ -970,7 +975,7 @@ json_lex_number(JsonLexContext lex, char s)`
`970`	`975`	`* here should be considered part of the token for error-reporting`
`971`	`976`	`* purposes.`
`972`	`977`	`*/`
`973`		`-for (p=s;JSON_ALPHANUMERIC_CHAR(*p)&&len<lex->input_length;p++,len++)`
	`978`	`+for (p=s;len<lex->input_length&&JSON_ALPHANUMERIC_CHAR(*p);p++,len++)`
`974`	`979`	`error= true;`
`975`	`980`	`lex->prev_token_terminator=lex->token_terminator;`
`976`	`981`	`lex->token_terminator=p;`
`@@ -1138,8 +1143,8 @@ report_json_context(JsonLexContext *lex)`
`1138`	`1143`	`line_number=1;`
`1139`	`1144`	`for (;;)`
`1140`	`1145`	`{`
`1141`		`-/* Always advance over newlines(context_end test is just paranoia)*/`
`1142`		`-if (*context_start=='\n'&&context_start<context_end)`
	`1146`	`+/* Always advance over newlines */`
	`1147`	`+if (context_start<context_end&&*context_start=='\n')`
`1143`	`1148`	`{`
`1144`	`1149`	`context_start++;`
`1145`	`1150`	`line_start=context_start;`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit6600856

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/json.c`

0 commit comments