summaryrefslogtreecommitdiffstats
path: root/src/jplist.c
AgeCommit message (Collapse)AuthorFilesLines
2023-01-08JSON: Only allow to convert PLIST_DICT or PLIST_ARRAY node to JSONGravatar Nikias Bassen1-0/+8
2022-11-02jplist: Prevent multiplication overflow by casting to larger typeGravatar Nikias Bassen1-2/+2
Found by CodeQL
2022-09-05jplist: Fix warning with `-Wbad-function-cast`Gravatar Nikias Bassen1-2/+2
2022-04-06jplist: Escape characters [0x00..0x1F] when converting to JSONGravatar Nikias Bassen1-5/+12
2022-02-15jplist: Fix another OOB read by using correct bounds checkGravatar Nikias Bassen1-1/+1
Credit to OSS-Fuzz
2022-02-11jplist: Fix OOB read by using correct bounds checkGravatar Nikias Bassen1-1/+1
Credit to OSS-Fuzz
2022-02-08jplist: Prevent read of uninitialized value by checking the bounds beforehandGravatar Nikias Bassen1-2/+2
Credit to OSS-Fuzz
2022-02-07jplist: Prevent integer overflow when parsing numerical valuesGravatar Nikias Bassen1-6/+29
Credit to OSS-Fuzz
2022-02-03jplist: Fix OOB read by making sure number of children is evenGravatar Nikias Bassen1-2/+6
Credit to OSS-Fuzz
2022-02-02jplist: Fix memory leak on parse errorGravatar Nikias Bassen1-0/+2
Credit to OSS-Fuzz
2022-02-02jplist: Improve numerical value parsing without copying data to stack bufferGravatar Nikias Bassen1-18/+62
Instead of calling strtoll() and atof(), the code now parses the numerical values directly to handle cases of non-0-terminated string data. The floating point value parsing is probably not ideal, but sufficient for our purposes.
2022-01-31jplist: Fix memory leak that occurs when JSON parsing failsGravatar Nikias Bassen1-0/+1
Credit to OSS-Fuzz
2022-01-31jplist: Fix OOB read in parse_primitive caused by missing 0-terminationGravatar Nikias Bassen1-2/+8
In parse_primitive, integer and double values are parsed by using strtoll and atof, which both expect the string to be 0-terminated. While this is not a problem in well-formed JSON files, it can be if the JSON data is not, possibly leading to a crash due to OOB memory access. This commit fixes it by copying the value data in question to a stack buffer and 0-terminate it, and use that buffer instead. Credit to OSS-Fuzz
2022-01-31jplist: Fix OOB read by making sure the JSMN token index is in valid rangeGravatar Nikias Bassen1-31/+48
Credit to OSS-Fuzz
2022-01-28jplist: Fix a few memory leaks that occur when parsing failsGravatar Nikias Bassen1-0/+5
Credit to OSS-Fuzz
2022-01-28jplist: Fix NULL pointer dereference by handling errors from unescape_string ↵Gravatar Nikias Bassen1-0/+6
correctly Credit to OSS-Fuzz
2022-01-28jplist: Fix use-after-free in unescape_stringGravatar Nikias Bassen1-2/+2
Credit to OSS-Fuzz
2022-01-25jplist: Make sure the jsmn parser tokens are initialized properlyGravatar Nikias Bassen1-3/+6
2022-01-25jplist: Make sure key values are also unescapedGravatar Nikias Bassen1-12/+19
2021-12-24json: Update parser (jsmn) to verify the length of the input dataGravatar Nikias Bassen1-1/+1
This way the string doesn't have to be 0-terminated.
2021-12-23jplist: Make strndup argument const to silence compiler warningGravatar Nikias Bassen1-1/+1
2021-12-23jplist: Fix build on WindowsGravatar Nikias Bassen1-0/+12
2021-12-23Add support for JSON formatGravatar Nikias Bassen1-0/+695