[LTP] [PATCH 09/15] ujson: reader: Do not increment depth on overflow

[Cyril Hrubis]

Hi!
> any_first() increments buf->depth before verifying whether
> depth > max_depth. If recursion overflows, depth is left skewed
> beyond max_depth. Check bounds before incrementing.
> 
> Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  libs/ujson/ujson_reader.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> index 272df4d55..b73a31b8f 100644
> --- a/libs/ujson/ujson_reader.c
> +++ b/libs/ujson/ujson_reader.c
> @@ -811,13 +811,13 @@ static int any_first(ujson_reader *buf, char b)
>  		return 1;
>  	}
>  
> -	buf->depth++;
> -
> -	if (buf->depth > buf->max_depth) {
> +	if (buf->depth >= buf->max_depth) {
>  		ujson_err(buf, "Recursion too deep");
>  		return 1;
>  	}
>  
> +	buf->depth++;
> +
>  	return 0;
>  }

I think that this is not a real problem, since once the error is set in
the buffer all subsequent calls to the library just return, since all of
them call check_err() at the start. That means that once the error is
set we will never call this function again.

-- 
Cyril Hrubis
chrubis@suse.cz