[I] encoding/json: json_decode can leave string values unterminated [mynewt-core]

["neosys007 (via GitHub)" <gi...@apache.org>]

neosys007 opened a new issue, #3596:
URL: https://github.com/apache/mynewt-core/issues/3596

   I rechecked current apache/mynewt-core master and this still looks like a real bug.
   
   In `encoding/json/src/json_decode.c`, the string decode path copies into `lptr` with `strncpy(lptr, valbuf, cursor->len)` and then only terminates `valbuf` itself. That means the destination buffer is not guaranteed to end with `` when the decoded JSON string reaches the caller's limit. If later code treats `lptr` as a normal C string, it can read past the intended end; if `lptr` points at a field inside a larger object, the bad termination can also become a setup for follow-on intra-object misuse.
   
   I checked the recent issue history before writing this and did not find a matching report for this sink.
   
   A safe fix would need to make the destination write length-aware, or otherwise guarantee termination on the target side instead of the source side.
   
   Relevant snippet:
   
   ```c
   (void)strncpy(lptr, valbuf, cursor->len);
   valbuf[sizeof(valbuf)-1] = '';
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] encoding/json: json_decode can leave string values unterminated [mynewt-core]

["kasjer (via GitHub)" <gi...@apache.org>]

kasjer closed issue #3596: encoding/json: json_decode can leave string values unterminated
URL: https://github.com/apache/mynewt-core/issues/3596


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org