[LTP] [PATCH 02/15] ujson: writer: Fix OOB read on invalid UTF-8

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

ujson_utf8_next_chsz() returns -1 on invalid UTF-8 sequences.
Because i is unsigned (size_t), adding -1 moves i back by one byte.
When i > 0, the loop steps back to the previous character and then
forward onto the invalid byte again, looping forever. When i == 0
(invalid byte at the start of the string or right after an escaped
character), i wraps to SIZE_MAX, causing out-of-bounds reads in
subsequent iterations and during output flushing. Stop and set an
error when an invalid UTF-8 byte sequence is encountered.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index c86a3b2af..b5da494d1 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -114,6 +114,10 @@ static inline int out_esc_str(ujson_writer *self, const char *val)
 
 	do {
 		next_chsz = ujson_utf8_next_chsz(val, i);
+		if (next_chsz < 0) {
+			err(self, "Invalid UTF-8 sequence");
+			return 1;
+		}
 
 		if (next_chsz == 1) {
 			switch (val[i]) {

-- 
2.51.0