[LTP] [PATCH v2 06/15] ujson: reader: Combine UTF-16 surrogate pairs

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

RFC 8259 specifies that characters outside the BMP may be represented
as a surrogate pair (\uD800-\uDBFF followed by \uDC00-\uDFFF).
Currently, each \uXXXX escape is converted independently to UTF-8,
producing invalid surrogate code point sequences instead of combining
them into a single UTF-8 sequence. Lone surrogates are also improperly
accepted. Combine valid surrogate pairs and reject unpaired surrogates.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 6dde06e01..7bf5b91f2 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -134,6 +134,34 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str,
 	if (ucode < 0)
 		return 0;
 
+	if (ucode >= 0xdc00 && ucode <= 0xdfff) {
+		ujson_err(buf, "Unpaired low surrogate");
+		return 0;
+	}
+
+	if (ucode >= 0xd800 && ucode <= 0xdbff) {
+		int32_t low;
+
+		if (peekb(buf) != '\\' || peekb_off(buf, 1) != 'u') {
+			ujson_err(buf, "Unpaired high surrogate");
+			return 0;
+		}
+
+		getb(buf);
+		getb(buf);
+
+		low = parse_ucode_cp(buf);
+		if (low < 0)
+			return 0;
+
+		if (low < 0xdc00 || low > 0xdfff) {
+			ujson_err(buf, "Invalid low surrogate in escape sequence");
+			return 0;
+		}
+
+		ucode = 0x10000 + (((ucode - 0xd800) << 10) | (low - 0xdc00));
+	}
+
 	if (!str)
 		return ujson_utf8_bytes(ucode);
 

-- 
2.51.0