diff options
| author | Eric Hawicz <erh+git@nimenees.com> | 2020-05-15 21:02:37 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-05-15 21:02:37 -0400 |
| commit | 4467e94110678c19edb2e36ec9c7e31ef7561a43 (patch) | |
| tree | 8b6f46e6251979cc32a3e846bed90c9c05057920 /printbuf.c | |
| parent | 228881c8fc287182f284a58d8279a32fbeae0b7f (diff) | |
| parent | 5d6fa331418d49f1bd488553fd1cfa9ab023fabb (diff) | |
| download | json-c-0.14.tar.gz | |
Merge pull request #608 from besser82/topic/besser82/json-c-0.14/CVE-2020-12762json-c-0.14
json-c-0.14: Fix CVE-2020-12762 - json-c through 0.14 has an integer overflow and out-of-bounds write ...
Diffstat (limited to 'printbuf.c')
| -rw-r--r-- | printbuf.c | 18 |
1 files changed, 16 insertions, 2 deletions
@@ -15,6 +15,7 @@ #include "config.h" +#include <limits.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -66,9 +67,16 @@ static int printbuf_extend(struct printbuf *p, int min_size) if (p->size >= min_size) return 0; - new_size = p->size * 2; - if (new_size < min_size + 8) + /* Prevent signed integer overflows with large buffers. */ + if (min_size > INT_MAX - 8) + return -1; + if (p->size > INT_MAX / 2) new_size = min_size + 8; + else { + new_size = p->size * 2; + if (new_size < min_size + 8) + new_size = min_size + 8; + } #ifdef PRINTBUF_DEBUG MC_DEBUG("printbuf_memappend: realloc " "bpos=%d min_size=%d old_size=%d new_size=%d\n", @@ -83,6 +91,9 @@ static int printbuf_extend(struct printbuf *p, int min_size) int printbuf_memappend(struct printbuf *p, const char *buf, int size) { + /* Prevent signed integer overflows with large buffers. */ + if (size > INT_MAX - p->bpos - 1) + return -1; if (p->size <= p->bpos + size + 1) { if (printbuf_extend(p, p->bpos + size + 1) < 0) @@ -100,6 +111,9 @@ int printbuf_memset(struct printbuf *pb, int offset, int charvalue, int len) if (offset == -1) offset = pb->bpos; + /* Prevent signed integer overflows with large buffers. */ + if (len > INT_MAX - offset) + return -1; size_needed = offset + len; if (pb->size < size_needed) { |