diff options
| author | Andrew Bromwich <a.bromwich@gmail.com> | 2022-04-20 22:30:35 +1000 |
|---|---|---|
| committer | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2022-05-20 17:49:13 +0900 |
| commit | a15d0e267a8a429cf2a2a4358080666ee2260526 (patch) | |
| tree | d2769775dadd891c7975949c76e8d33d1c27bc93 /ext/json | |
| parent | 767f3904ee2a15575c292d89578de7669f169346 (diff) | |
[flori/json] Fix parser bug for empty string allocation
When `HAVE_RB_ENC_INTERNED_STR` is enabled it is possible to
pass through a null pointer to `rb_enc_interned_str` resulting
in a segfault
Fixes #495
https://github.com/flori/json/commit/b59368a8c2
Diffstat (limited to 'ext/json')
| -rw-r--r-- | ext/json/parser/parser.c | 8 | ||||
| -rw-r--r-- | ext/json/parser/parser.rl | 8 |
2 files changed, 16 insertions, 0 deletions
diff --git a/ext/json/parser/parser.c b/ext/json/parser/parser.c index b7de60ddfb..8b860c4101 100644 --- a/ext/json/parser/parser.c +++ b/ext/json/parser/parser.c @@ -2363,9 +2363,17 @@ static VALUE json_string_unescape(char *string, char *stringEnd, int intern, int char buf[4]; if (bufferSize > MAX_STACK_BUFFER_SIZE) { +# ifdef HAVE_RB_ENC_INTERNED_STR + bufferStart = buffer = ALLOC_N(char, bufferSize ? bufferSize : 1); +# else bufferStart = buffer = ALLOC_N(char, bufferSize); +# endif } else { +# ifdef HAVE_RB_ENC_INTERNED_STR + bufferStart = buffer = ALLOCA_N(char, bufferSize ? bufferSize : 1); +# else bufferStart = buffer = ALLOCA_N(char, bufferSize); +# endif } while (pe < stringEnd) { diff --git a/ext/json/parser/parser.rl b/ext/json/parser/parser.rl index 15e6b929f5..2dee80ee3b 100644 --- a/ext/json/parser/parser.rl +++ b/ext/json/parser/parser.rl @@ -462,9 +462,17 @@ static VALUE json_string_unescape(char *string, char *stringEnd, int intern, int char buf[4]; if (bufferSize > MAX_STACK_BUFFER_SIZE) { +# ifdef HAVE_RB_ENC_INTERNED_STR + bufferStart = buffer = ALLOC_N(char, bufferSize ? bufferSize : 1); +# else bufferStart = buffer = ALLOC_N(char, bufferSize); +# endif } else { +# ifdef HAVE_RB_ENC_INTERNED_STR + bufferStart = buffer = ALLOCA_N(char, bufferSize ? bufferSize : 1); +# else bufferStart = buffer = ALLOCA_N(char, bufferSize); +# endif } while (pe < stringEnd) { |