[LTP] [PATCH 12/15] ujson: reader: Reject \u0000 escape in strings

[Cyril Hrubis]

Hi!
> String values and object IDs are returned as NUL-terminated C strings.
> A \u0000 escape was written as a NUL byte into the output buffer,
> silently truncating the string. Report an error instead.
> 
> Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  libs/ujson/ujson_reader.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> index dd1d96d5f..c8b8979ec 100644
> --- a/libs/ujson/ujson_reader.c
> +++ b/libs/ujson/ujson_reader.c
> @@ -135,6 +135,12 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str,
>  	if (ucode < 0)
>  		return 0;
>  
> +	/* Strings are NUL-terminated, an embedded NUL would truncate them */
> +	if (!ucode) {
> +		ujson_err(buf, "\\u0000 is not supported");
> +		return 0;
> +	}
> +
>  	if (ucode >= 0xd800 && ucode <= 0xdbff) {
>  		int32_t low;

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

-- 
Cyril Hrubis
chrubis@suse.cz