Ver código fonte

fix(json): signed integer overflow in subtraction

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14853
Credit to oss-fuzz
Stefan Profanter 4 anos atrás
pai
commit
656c3a3dfa
1 arquivos alterados com 2 adições e 2 exclusões
  1. 2 2
      src/ua_types_encoding_json.c

+ 2 - 2
src/ua_types_encoding_json.c

@@ -2622,8 +2622,8 @@ DECODE_JSON(Variant) {
         return UA_STATUSCODE_GOOD;
     }
 
-    size_t size = (size_t)(parseCtx->tokenArray[searchResultType].end -
-                           parseCtx->tokenArray[searchResultType].start);
+    size_t size = ((size_t)parseCtx->tokenArray[searchResultType].end -
+                   (size_t)parseCtx->tokenArray[searchResultType].start);
 
     /* check if size is zero or the type is not a number */
     if(size < 1 || parseCtx->tokenArray[searchResultType].type != JSMN_PRIMITIVE)