Explorar o código

fix: Zero pointer access when invalid type of extension object in json

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17637
Credit to oss-fuzz
Stefan Profanter %!s(int64=4) %!d(string=hai) anos
pai
achega
7d6f3484de
Modificáronse 1 ficheiros con 3 adicións e 0 borrados
  1. 3 0
      src/ua_types_encoding_json.c

+ 3 - 0
src/ua_types_encoding_json.c

@@ -2946,6 +2946,9 @@ Variant_decodeJsonUnwrapExtensionObject(UA_Variant *dst, const UA_DataType *type
     if(encoding == 0 || typeOfBody != NULL) {
         /*This value is 0 if the body is Structure encoded as a JSON object (see 5.4.6).*/
         /* Found a valid type and it is structure encoded so it can be unwrapped */
+        if (typeOfBody == NULL)
+            return UA_STATUSCODE_BADDECODINGERROR;
+
         dst->type = typeOfBody;
 
         /* Allocate memory for type*/