This is an automated email from the ASF dual-hosted git repository. kasjer pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
commit e4d6b5e7180cbdcf2d9b7c1ce9c48cc6ae32897c Author: Jerzy Kasenberg <[email protected]> AuthorDate: Thu Jun 18 13:36:58 2026 +0200 encoding/json: Fix not terminated string If parsed string value would not fit into provided buffer value would be copied but not nul terminated. Now if string value would not fit with terminator function fails with JSON_ERR_STRLONG as was intented. Extra terminating line that fixed incorrect buffer is also removed. Decoding code allowed attribute name to have 30 chars (JSON_ATTR_MAX - 1) instead of intended JSON_ATTR_MAX that would be 31. That is also fixed. Signed-off-by: Jerzy Kasenberg <[email protected]> --- encoding/json/src/json_decode.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/encoding/json/src/json_decode.c b/encoding/json/src/json_decode.c index e56778fd4..252f58e3e 100644 --- a/encoding/json/src/json_decode.c +++ b/encoding/json/src/json_decode.c @@ -265,7 +265,7 @@ json_internal_read_object(struct json_buffer *jb, maxlen = 5; /* false */ } pval = valbuf; - } else if (pattr >= attrbuf + JSON_ATTR_MAX - 1) { + } else if ((pattr - attrbuf) >= JSON_ATTR_MAX) { /* don't update end here, leave at attribute start */ return JSON_ERR_ATTRLEN; } else { @@ -308,8 +308,7 @@ json_internal_read_object(struct json_buffer *jb, } else if (c == '"') { *pval++ = '\0'; state = post_val; - } else if (pval > valbuf + JSON_VAL_MAX - 1 - || pval > valbuf + maxlen) { + } else if ((pval - valbuf) >= JSON_VAL_MAX || (pval - valbuf) >= maxlen) { /* don't update end here, leave at value start */ return JSON_ERR_STRLONG; /* */ } else { @@ -459,7 +458,6 @@ json_internal_read_object(struct json_buffer *jb, return JSON_ERR_NOPARSTR; } (void)strncpy(lptr, valbuf, cursor->len); - valbuf[sizeof(valbuf)-1] = '\0'; break; case t_boolean: { bool tmp = (strcmp(valbuf, "true") == 0);
