Fix CVE-2017-16516 · Pull Request !45 · src-openEuler/yajl

This pull request addresses a significant security vulnerability identified as CVE-2017-16516 in the YAJL JSON parsing library. The issue arises from a potential buffer overread when processing malformed JSON inputs that could lead to a denial of service (DoS) or possible information disclosure.

**Origin of the Issue:**
- **GitHub Issue Tracker**: [YAJL GitHub Issue #248](https://github.com/lloyd/yajl/issues/248)
- **Debian Bug Tracker**: [Debian Bug Report #1040036](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036)
https://gitee.com/src-openeuler/yajl/issues/IBMPKJ
**Code Changes Introduced:**

1. **Bounds Checking in Surrogate Pair Processing**
   - Ensures that checks for surrogate pairs in UTF-16 encodings do not read past the buffer limit.
   ```diff
   @@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
                       end+=3;
                       /* check if this is a surrogate */
                       if ((codepoint & 0xFC00) == 0xD800) {
   -                        end++;
   -                        if (str[end] == '\\' && str[end + 1] == 'u') {
   +                        if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
   +                            end++;
                             unsigned int surrogate = 0;
                             hexToDigit(&surrogate, str + end + 2);
                             codepoint =
   ```

**Impact of Changes:**
The modifications are designed to ensure that YAJL correctly handles edge cases in JSON encoding, specifically addressing issues with improper memory access in handling of Unicode surrogate pairs. This change prevents the library from causing application crashes due to buffer overread, which is crucial for applications relying on YAJL for JSON processing.

Your feedback and additional validation would be highly appreciated to expedite the merging of this security fix.

**References:**
- Original commit in Debian that addressed the issue: [Link to commit](https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce)

src-openEuler/yajl .gitee-modal { width: 500px !important; }

搜索帮助

src-openEuler/yajl