[LTP] [PATCH 02/15] ujson: writer: Fix OOB read on invalid UTF-8

[Cyril Hrubis]

Hi!
> ujson_utf8_next_chsz() returns -1 on invalid UTF-8 sequences.
> Because i is unsigned (size_t), adding -1 moves i back by one byte.
> When i > 0, the loop steps back to the previous character and then
> forward onto the invalid byte again, looping forever. When i == 0
> (invalid byte at the start of the string or right after an escaped
> character), i wraps to SIZE_MAX, causing out-of-bounds reads in
> subsequent iterations and during output flushing. Stop and set an
> error when an invalid UTF-8 byte sequence is encountered.
> 
> Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  libs/ujson/ujson_writer.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
> index c86a3b2af..b5da494d1 100644
> --- a/libs/ujson/ujson_writer.c
> +++ b/libs/ujson/ujson_writer.c
> @@ -114,6 +114,10 @@ static inline int out_esc_str(ujson_writer *self, const char *val)
>  
>  	do {
>  		next_chsz = ujson_utf8_next_chsz(val, i);
> +		if (next_chsz < 0) {
> +			err(self, "Invalid UTF-8 sequence");
> +			return 1;
> +		}

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

We should really get the fix into the ujson library as well.

-- 
Cyril Hrubis
chrubis@suse.cz