Commit ede26311 authored by Anton Einax's avatar Anton Einax Committed by Jim Harris
Browse files

json: fail on invalid object_end call 



Fixes #3643

Currently, the `spdk_json_write_object_end` call does not check whether
an indent can be removed, decrementing the indent counter and causing a
potential integer underflow.

This patch adds a check as is done in `spdk_json_write_array_end` to
prevent this and fail accordingly.

Change-Id: I3238ee084056e830a28313badd9c54d98a8e211c
Signed-off-by: default avatarAnton Einax <butterino@proton.me>
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/25815


Community-CI: Mellanox Build Bot
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Tested-by: default avatarSPDK Automated Test System <spdkbot@gmail.com>
Reviewed-by: default avatarJim Harris <jim.harris@nvidia.com>
Reviewed-by: default avatarChangpeng Liu <changpeliu@tencent.com>
parent 93ae89ab

lib/json/json_write.c

+1 −0
Original line number Diff line number Diff line
@@ -591,6 +591,7 @@ int 
spdk_json_write_object_end(struct spdk_json_write_ctx *w)

{

	w->first_value = false;

	if (w->indent == 0) { return fail(w); }

	w->indent--;

	if (!w->new_indent) {

		if (emit_fmt(w, "\n", 1)) { return fail(w); }

test/unit/lib/json/json_write.c/json_write_ut.c

+12 −0
Original line number Diff line number Diff line
@@ -863,6 +863,17 @@ test_write_val(void) 
	END("{\"a\":[1,2,3],\"b\":{\"c\":\"d\"},\"e\":true,\"f\":false,\"g\":null}");

}



static void

test_object_end_fail(void)

{

	struct spdk_json_write_ctx *w;

	BEGIN();

	VAL_OBJECT_BEGIN();

	VAL_OBJECT_END();

	CU_ASSERT(spdk_json_write_object_end(w) < 0);

	END_FAIL();

}



int

main(int argc, char **argv)

{
@@ -889,6 +900,7 @@ main(int argc, char **argv) 
	CU_ADD_TEST(suite, test_write_object);

	CU_ADD_TEST(suite, test_write_nesting);

	CU_ADD_TEST(suite, test_write_val);

	CU_ADD_TEST(suite, test_object_end_fail);





	num_failures = spdk_ut_run_tests(argc, argv, NULL);