MojoJson
MojoJson copied to clipboard
heap-buffer-overflow in func SkipString
input value : "@<=>?@ABCDEFGHIJiLM$^^&(^( you can use ASAN compile the lib and the API JsonValue* value = AJson->Parse(jsonString); it supply and input this value to the API . it can trige in a buffer-overflow bug.
==2238917==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000323c at pc 0x564852e329cc bp 0x7fff7edbed90 sp 0x7fff7edbed80 READ of size 1 at 0x60200000323c thread T0 #0 0x564852e329cb in SkipString /opt1/software/MojoJson/Json.c:695 #1 0x564852e32b03 in ParseString /opt1/software/MojoJson/Json.c:719 #2 0x564852e33b76 in ParseValue /opt1/software/MojoJson/Json.c:858 #3 0x564852e34143 in Parse /opt1/software/MojoJson/Json.c:949 #4 0x564852e342ef in easyloop /opt1/software/MojoJson/test.c:8 #5 0x564852e44355 in main /opt1/software/betafuzz/srap/wrapentry.c:98 #6 0x7f587147ad8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #7 0x7f587147ae3f
I think the problem is that the string is not a valid json format — "@<=>?@ABCDEFGHIJiLM$^^&(^(
.