jsmn jsondump heap-buffer-overflow read vulnerability

Vulnerability Overview An out-of-bounds read vulnerability exists in the file. This vulnerability occurs during the processing of non-standard JSON syntax, specifically within the function. When the parser encounters a token containing multiple sub-elements, the function unconditionally iterates through the entire token array. This behavior can lead to accessing memory beyond the boundaries of the token array when constructing deeply nested documents, resulting in a heap buffer over-read. Scope of Impact Affected File: Trigger Condition: When the input consists of a crafted deeply nested JSON document, the function attempts to access memory beyond the boundaries of the token array. Potential Risk: This may cause program crashes or introduce security vulnerabilities, such as information leakage or code execution. Remediation Plan The fix involves adding a boundary check within the function to ensure that traversal of the token array does not exceed its limits. The specific modifications are as follows: 1. Add Boundary Check: Before traversing the token array, verify that the current index is less than the size of the token array. 2. Update Code: Add the following code to the function: POC Code The following is the POC code used to test this vulnerability: ```c / Regression test for json issue #249. jsmn's non-strict grammar (the default, without -DJSON_STRICT) accepts some inputs that are not valid JSON. One consequence is that a token can end up with a "size" that does not match how many children are actually stored after it in the token pool. The example shipped in example/jsondump.c trusted that size unconditionally and recursed through the token tree using it, which let a crafted, malformed document walk dump() straight past the end of the token array (an AddressSanitizer heap-buffer-overflow at jsondump.c:34, reachable simply by piping the input into the unmodified example). This test reuses the actual dump() from example/jsondump.c (not a copy of it) so that a regression against the real bounds check gets caught here. / #define main jsondump_main #include "../example/jsondump.c" #undef main / Builds a deeply nested, deliberately malformed document: a run of ordinary '{'s, opening a spot where a : is missing after a key and a string " follows shortly after, more nesting, a primitive value, and a matching run of closing braces. Jsmn's non-strict grammar parses this without returning an error, but the resulting token tree does not actually hold as many children as the object tokens near the malformed spot claim. / static char build_oob_input(size_t out_len) { const char open_key = "{\"a\":\""; const char malformed = "{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\"a\":{\

Goal Reached Thanks to every supporter — we hit 100%!

jsmn jsondump heap-buffer-overflow read vulnerability

More from this source