bblanchon/ArduinoJson
1
0
Fork 1
mirror of https://github.com/bblanchon/ArduinoJson.git synced 2025-11-15 14:59:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix integer overflow in MsgPackDeserializer

Browse Source
This commit is contained in:
Benoit Blanchon
2024-06-08 18:49:42 +02:00
parent 45611924f3
commit 208e7a3304
4 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
extras/tests/MixedConfiguration/string_length_size_2.cpp
View File

@@ -112,6 +112,15 @@ TEST_CASE("ARDUINOJSON_STRING_LENGTH_SIZE == 2") {
REQUIRE(err == DeserializationError::NoMemory);
}
// https://oss-fuzz.com/testcase?key=5354792971993088
SECTION("doesn't overflow if binary size == 0xFFFF") {
auto input = "\xc5\xff\xff"_s;
auto err = deserializeMsgPack(doc, input);
REQUIRE(err == DeserializationError::NoMemory);
}
SECTION("returns Ok if extension size <= 65531") {
auto input = "\xc8\xff\xfb\x01" + std::string(65531, '?');
@@ -120,7 +129,7 @@ TEST_CASE("ARDUINOJSON_STRING_LENGTH_SIZE == 2") {
REQUIRE(err == DeserializationError::Ok);
}
SECTION("returns NoMemory if binary size >= 65532") {
SECTION("returns NoMemory if extension size >= 65532") {
auto input = "\xc8\xff\xfc\x01" + std::string(65532, '?');
auto err = deserializeMsgPack(doc, input);

17
extras/tests/MixedConfiguration/string_length_size_4.cpp
View File

@@ -72,6 +72,23 @@ TEST_CASE("ARDUINOJSON_STRING_LENGTH_SIZE == 4") {
REQUIRE(err == DeserializationError::Ok);
}
// https://oss-fuzz.com/testcase?key=5354792971993088
SECTION("doesn't overflow if binary size == 0xFFFFFFFF") {
auto input = "\xc6\xff\xff\xff\xff"_s;
auto err = deserializeMsgPack(doc, input);
REQUIRE(err == DeserializationError::NoMemory);
}
SECTION("doesn't overflow if string size == 0xFFFFFFFF") {
auto input = "\xdb\xff\xff\xff\xff???????????????????"_s;
auto err = deserializeMsgPack(doc, input);
REQUIRE(err != DeserializationError::Ok);
}
}
SECTION("bin 32 deserialization") {