Skip to content

Commit 2e33c21

Browse files
authored
Fix fuzzer off by one error (#1047)
* Fix fuzzer off by one error Currently the fuzzer has an off by one error, as it passing a bad length to the CharReader::parse method, resulting in a heap buffer overflow. * Rebase master, rerun clang format
1 parent ddc0748 commit 2e33c21

File tree

3 files changed

+6
-3
lines changed

3 files changed

+6
-3
lines changed

Diff for: example/readFromString/readFromString.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
#include <iostream>
33
/**
44
* \brief Parse a raw string into Value object using the CharReaderBuilder
5-
* class, or the legacy Reader class.
6-
* Example Usage:
5+
* class, or the legacy Reader class.
6+
* Example Usage:
77
* $g++ readFromString.cpp -ljsoncpp -std=c++11 -o readFromString
88
* $./readFromString
99
* colin

Diff for: src/lib_json/json_value.cpp

+3-1
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,9 @@ LogicError::LogicError(String const& msg) : Exception(msg) {}
210210
JSONCPP_NORETURN void throwRuntimeError(String const& msg) {
211211
throw RuntimeError(msg);
212212
}
213-
JSONCPP_NORETURN void throwLogicError(String const& msg) { throw LogicError(msg); }
213+
JSONCPP_NORETURN void throwLogicError(String const& msg) {
214+
throw LogicError(msg);
215+
}
214216
#else // !JSON_USE_EXCEPTION
215217
JSONCPP_NORETURN void throwRuntimeError(String const& msg) { abort(); }
216218
JSONCPP_NORETURN void throwLogicError(String const& msg) { abort(); }

Diff for: src/test_lib_json/fuzz.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
2525

2626
uint32_t hash_settings = *(const uint32_t*)data;
2727
data += sizeof(uint32_t);
28+
size -= sizeof(uint32_t);
2829

2930
builder.settings_["failIfExtra"] = hash_settings & (1 << 0);
3031
builder.settings_["allowComments_"] = hash_settings & (1 << 1);

0 commit comments

Comments
 (0)