database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-11-11 01:42:22 +03:00
Code Activity

When rendering JSONB back into text JSON, report an error if a zero-length

Browse Source 
integer or floating-point node is encountered.  Otherwise, if the node occurs
at the very end of the JSONB, the rendering logic might read one byte past
the end of the initialized part of the BLOB byte array.  OSSFuzz 66284.

FossilOrigin-Name: b0eb279ea83c1c788c39fb90e178ec99fa4c782195c376a420c661fedf4545a7
This commit is contained in:
drh
2024-01-29 12:50:32 +00:00
parent 4c11a5251a
commit 3fc7a34efc
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
manifest
View File

@@ -1,5 +1,5 @@
C Use\s__ppc__\sinstead\sof\s__POWERPC__\sto\sidentify\s32-bit\sPowerPC\sprocessors.\n[forum:/forumpost/34794846ce|Forum\spost\s34794846ce]. C When\srendering\sJSONB\sback\sinto\stext\sJSON,\sreport\san\serror\sif\sa\szero-length\ninteger\sor\sfloating-point\snode\sis\sencountered.\s\sOtherwise,\sif\sthe\snode\soccurs\nat\sthe\svery\send\sof\sthe\sJSONB,\sthe\srendering\slogic\smight\sread\sone\sbyte\spast\nthe\send\sof\sthe\sinitialized\spart\sof\sthe\sBLOB\sbyte\sarray.\s\sOSSFuzz\s66284.
D 2024-01-28T20:42:12.641 D 2024-01-29T12:50:32.533
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -698,7 +698,7 @@ F src/hash.h 3340ab6e1d13e725571d7cee6d3e3135f0779a7d8e76a9ce0a85971fa3953c51
F src/hwtime.h f9c2dfb84dce7acf95ce6d289e46f5f9d3d1afd328e53da8f8e9008e3b3caae6 F src/hwtime.h f9c2dfb84dce7acf95ce6d289e46f5f9d3d1afd328e53da8f8e9008e3b3caae6
F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
F src/insert.c 3f0a94082d978bbdd33c38fefea15346c6c6bffb70bc645a71dc0f1f87dd3276 F src/insert.c 3f0a94082d978bbdd33c38fefea15346c6c6bffb70bc645a71dc0f1f87dd3276
F src/json.c b2189995bb2f5eeac20a0282983cc82198fc77f9429708468ba360bbacb6fa80 F src/json.c bf20b47d110aa0ea316e0ab77ccb407bd9c73eac2604e8d238823ceedd270d5b
F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
F src/loadext.c 7432c944ff197046d67a1207790a1b13eec4548c85a9457eb0896bb3641dfb36 F src/loadext.c 7432c944ff197046d67a1207790a1b13eec4548c85a9457eb0896bb3641dfb36
F src/main.c 438b95162acfa17b7d218f586f5bde11d6ae82bcf030c9611fc537556870ad6b F src/main.c 438b95162acfa17b7d218f586f5bde11d6ae82bcf030c9611fc537556870ad6b
@@ -2161,8 +2161,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
P d4c193f0b49f4950b20c2f0e6aa037d2ed7d8c0b4687c14923b3a0d0d4a1b3fd P c974d9313b60591bcd554c3ec652a8040d382930e30778e6be8a875145b0b3da
R 46f9da2da907badd19298ace66a20031 R 0207b7627e17db2286de3e2f665c21a5
U drh U drh
Z c2041b302fcfe4f462cbcda587ab473e Z b94072d2a610a36c15c6ae7e7c61c766
# Remove this line to create a well-formed Fossil manifest. # Remove this line to create a well-formed Fossil manifest.

2
manifest.uuid
View File

@@ -1 +1 @@
c974d9313b60591bcd554c3ec652a8040d382930e30778e6be8a875145b0b3da b0eb279ea83c1c788c39fb90e178ec99fa4c782195c376a420c661fedf4545a7

4
src/json.c
View File

@@ -2124,6 +2124,7 @@ static u32 jsonTranslateBlobToText(
} }
case JSONB_INT: case JSONB_INT:
case JSONB_FLOAT: { case JSONB_FLOAT: {
if( sz==0 ) goto malformed_jsonb;
jsonAppendRaw(pOut, (const char*)&pParse->aBlob[i+n], sz); jsonAppendRaw(pOut, (const char*)&pParse->aBlob[i+n], sz);
break; break;
} }
@@ -2132,6 +2133,7 @@ static u32 jsonTranslateBlobToText(
sqlite3_uint64 u = 0; sqlite3_uint64 u = 0;
const char *zIn = (const char*)&pParse->aBlob[i+n]; const char *zIn = (const char*)&pParse->aBlob[i+n];
int bOverflow = 0; int bOverflow = 0;
if( sz==0 ) goto malformed_jsonb;
if( zIn[0]=='-' ){ if( zIn[0]=='-' ){
jsonAppendChar(pOut, '-'); jsonAppendChar(pOut, '-');
k++; k++;
@@ -2154,6 +2156,7 @@ static u32 jsonTranslateBlobToText(
case JSONB_FLOAT5: { /* Float literal missing digits beside "." */ case JSONB_FLOAT5: { /* Float literal missing digits beside "." */
u32 k = 0; u32 k = 0;
const char *zIn = (const char*)&pParse->aBlob[i+n]; const char *zIn = (const char*)&pParse->aBlob[i+n];
if( sz==0 ) goto malformed_jsonb;
if( zIn[0]=='-' ){ if( zIn[0]=='-' ){
jsonAppendChar(pOut, '-'); jsonAppendChar(pOut, '-');
k++; k++;
@@ -2291,6 +2294,7 @@ static u32 jsonTranslateBlobToText(
} }
default: { default: {
malformed_jsonb:
pOut->eErr |= JSTRING_MALFORMED; pOut->eErr |= JSTRING_MALFORMED;
break; break;
} }