wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-25 12:04:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(json): reject malformed hex input

Browse Source 
Reject odd-length and non-hex strings before decoding them.

Tested: 1796 ASan/UBSan tests in amalgamated and unamalgamated builds
This commit is contained in:
94xhn committed 2026-07-16 08:33:06 +08:00
1 parent bc69625a5e
commit dc52d8b1dc
5 files changed
+29 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/unit_test.c
+11 -1
View File
@@ -3741,13 +3741,23 @@ static void test_json(void) {
ASSERT(b == true);
ASSERT(mg_json_get(json, "$.b[2]", &len) < 0);
json = mg_str("[\"YWJj\", \"0100026869\"]");
json = mg_str("[\"YWJj\", \"0100026869\", \"\", \"abc\", \"0g\"]");
ASSERT((str = mg_json_get_b64(json, "$[0]", &len)) != NULL);
ASSERT(len == 3 && memcmp(str, "abc", (size_t) len) == 0);
mg_free(str);
ASSERT((str = mg_json_get_hex(json, "$[1]", &len)) != NULL);
ASSERT(len == 5 && memcmp(str, "\x01\x00\x02hi", (size_t) len) == 0);
mg_free(str);
ASSERT((str = mg_json_get_hex(json, "$[2]", &len)) != NULL);
ASSERT(len == 0 && str[0] == '\0');
mg_free(str);
len = 42;
str = mg_json_get_hex(json, "$[3]", &len);
ASSERT(str == NULL && len == 42);
mg_free(str);
str = mg_json_get_hex(json, "$[4]", &len);
ASSERT(str == NULL && len == 42);
mg_free(str);
json = mg_str("{\"a\":[1,2,3], \"ab\": 2}");
ASSERT(mg_json_get_long(json, "$.a[0]", -42) == 1);