Browse Source

fix: Use-of-uninitialized-value in json decode

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14620
Credit to oss-fuzz
Stefan Profanter 5 years ago
parent
commit
cc7d2558ff
1 changed files with 3 additions and 0 deletions
  1. 3 0
      src/ua_types_encoding_json.c

+ 3 - 0
src/ua_types_encoding_json.c

@@ -2259,6 +2259,9 @@ searchObjectForKeyRec(const char *searchKey, CtxJson *ctx,
                 if(jsoneq((char*)ctx->pos, &parseCtx->tokenArray[parseCtx->index], searchKey) == 0) {
                     /*found*/
                     parseCtx->index++; /*We give back a pointer to the value of the searched key!*/
+                    if (parseCtx->index >= parseCtx->tokenCount)
+                        /* We got invalid json. See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14620 */
+                        return UA_STATUSCODE_BADOUTOFRANGE;
                     *resultIndex = parseCtx->index;
                     return UA_STATUSCODE_GOOD;
                 }