Out-of-bounds read in jsmn jsondump example via malformed JSON input

Vulnerability Overview Vulnerability Name: Fix out-of-bounds read in example/jsondump.c on malformed input #250 Vulnerability Description: jsmn's non-strict syntax (which is the default, without ) parses some inputs that are not valid JSON without returning an error. A side effect is that the field of a token, which is used to calculate the actual number of child nodes that exist in the token pool, may claim there are more children than actually exist. This causes issues when parsing slightly unusual paths through a malformed document (e.g., a key followed by a ). Specific Impact: In , the function unconditionally trusts and uses it to iterate over the token array. In a carefully constructed deeply nested document, this directly reads beyond the end of the array. Building the unmodified example with ASan and piping a 1534-byte malformed input to yields a clear heap-buffer-overflow read in at . Scope of Impact Affected File: Affected Function: Trigger Conditions: Parsing malformed JSON input, particularly those containing deeply nested structures and keys followed by . Remediation Fix Method: Missing boundary checks were added to the function. Before forming a pointer to the next child or dereferencing after a recursive call returns, it checks whether the token pool still has space. This is achieved using the budget already passed through recursion, stopping early in the loop. Testing: was added and linked to . It constructs a malformed document at runtime and inserts it directly into (rather than copying it, ensuring the test tracks the actual shipped code). It verifies that the code crashes under the old logic and passes successfully after the fix. POC Code ```c // test/test_jsondump_oob.c #include #include #include #include "jsmn.h" // Construct malformed JSON input static const char *malformed_json = "{\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"nested\": {\"key\": {\"

Goal Reached Thanks to every supporter — we hit 100%!

Out-of-bounds read in jsmn jsondump example via malformed JSON input

More from this source