3party/cJSON
0
0
Fork 0
mirror of https://github.com/DaveGamble/cJSON.git synced 2025-01-14 03:18:00 +08:00
Code Issues Projects Releases Wiki Activity

add NULL checkings (#809)

Browse Source 
* add NULL checks in cJSON_SetValuestring

Fixes #803(CVE-2023-50472)

* add NULL check in cJSON_InsertItemInArray

Fixes #802(CVE-2023-50471)

* add tests for NULL checks

add tests for NULL checks in cJSON_InsertItemInArray and cJSON_SetValuestring
This commit is contained in:
Lee 2023-12-18 11:47:52 +08:00 committed by GitHub
parent cb8693b058
commit 60ff122ef5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
cJSON.c
View File

@ -401,7 +401,12 @@ CJSON_PUBLIC(char*) cJSON_SetValuestring(cJSON *object, const char *valuestring)
{ {
char *copy = NULL; char *copy = NULL;
/* if object's type is not cJSON_String or is cJSON_IsReference, it should not set valuestring */ /* if object's type is not cJSON_String or is cJSON_IsReference, it should not set valuestring */
if (!(object->type & cJSON_String) || (object->type & cJSON_IsReference)) if ((object == NULL) || !(object->type & cJSON_String) || (object->type & cJSON_IsReference))
{
return NULL;
}
/* return NULL if the object is corrupted */
if (object->valuestring == NULL)
{ {
return NULL; return NULL;
} }
@ -2264,7 +2269,7 @@ CJSON_PUBLIC(cJSON_bool) cJSON_InsertItemInArray(cJSON *array, int which, cJSON
{ {
cJSON *after_inserted = NULL; cJSON *after_inserted = NULL;
if (which < 0) if (which < 0 || newitem == NULL)
{ {
return false; return false;
} }
@ -2275,6 +2280,11 @@ CJSON_PUBLIC(cJSON_bool) cJSON_InsertItemInArray(cJSON *array, int which, cJSON
return add_item_to_array(array, newitem); return add_item_to_array(array, newitem);
} }
if (after_inserted != array->child && newitem->prev == NULL) {
/* return false if after_inserted is a corrupted array item */
return false;
}
newitem->next = after_inserted; newitem->next = after_inserted;
newitem->prev = after_inserted->prev; newitem->prev = after_inserted->prev;
after_inserted->prev = newitem; after_inserted->prev = newitem;

21
tests/misc_tests.c
View File

@ -352,6 +352,19 @@ static void cjson_functions_should_not_crash_with_null_pointers(void)
{ {
char buffer[10]; char buffer[10];
cJSON *item = cJSON_CreateString("item"); cJSON *item = cJSON_CreateString("item");
cJSON *array = cJSON_CreateArray();
cJSON *item1 = cJSON_CreateString("item1");
cJSON *item2 = cJSON_CreateString("corrupted array item3");
cJSON *corruptedString = cJSON_CreateString("corrupted");
struct cJSON *originalPrev;
add_item_to_array(array, item1);
add_item_to_array(array, item2);
originalPrev = item2->prev;
item2->prev = NULL;
free(corruptedString->valuestring);
corruptedString->valuestring = NULL;
cJSON_InitHooks(NULL); cJSON_InitHooks(NULL);
TEST_ASSERT_NULL(cJSON_Parse(NULL)); TEST_ASSERT_NULL(cJSON_Parse(NULL));
@ -411,6 +424,8 @@ static void cjson_functions_should_not_crash_with_null_pointers(void)
cJSON_DeleteItemFromObject(item, NULL); cJSON_DeleteItemFromObject(item, NULL);
cJSON_DeleteItemFromObjectCaseSensitive(NULL, "item"); cJSON_DeleteItemFromObjectCaseSensitive(NULL, "item");
cJSON_DeleteItemFromObjectCaseSensitive(item, NULL); cJSON_DeleteItemFromObjectCaseSensitive(item, NULL);
TEST_ASSERT_FALSE(cJSON_InsertItemInArray(array, 0, NULL));
TEST_ASSERT_FALSE(cJSON_InsertItemInArray(array, 1, item));
TEST_ASSERT_FALSE(cJSON_InsertItemInArray(NULL, 0, item)); TEST_ASSERT_FALSE(cJSON_InsertItemInArray(NULL, 0, item));
TEST_ASSERT_FALSE(cJSON_InsertItemInArray(item, 0, NULL)); TEST_ASSERT_FALSE(cJSON_InsertItemInArray(item, 0, NULL));
TEST_ASSERT_FALSE(cJSON_ReplaceItemViaPointer(NULL, item, item)); TEST_ASSERT_FALSE(cJSON_ReplaceItemViaPointer(NULL, item, item));
@ -427,10 +442,16 @@ static void cjson_functions_should_not_crash_with_null_pointers(void)
TEST_ASSERT_NULL(cJSON_Duplicate(NULL, true)); TEST_ASSERT_NULL(cJSON_Duplicate(NULL, true));
TEST_ASSERT_FALSE(cJSON_Compare(item, NULL, false)); TEST_ASSERT_FALSE(cJSON_Compare(item, NULL, false));
TEST_ASSERT_FALSE(cJSON_Compare(NULL, item, false)); TEST_ASSERT_FALSE(cJSON_Compare(NULL, item, false));
TEST_ASSERT_NULL(cJSON_SetValuestring(NULL, "test"));
TEST_ASSERT_NULL(cJSON_SetValuestring(corruptedString, "test"));
cJSON_Minify(NULL); cJSON_Minify(NULL);
/* skipped because it is only used via a macro that checks for NULL */ /* skipped because it is only used via a macro that checks for NULL */
/* cJSON_SetNumberHelper(NULL, 0); */ /* cJSON_SetNumberHelper(NULL, 0); */
/* restore corrupted item2 to delete it */
item2->prev = originalPrev;
cJSON_Delete(corruptedString);
cJSON_Delete(array);
cJSON_Delete(item); cJSON_Delete(item);
} }