postgres.git / summary / log / commit / refs

commit    41adf9d960c0105ada615574126d5568d552f4db
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Thu May 09 03:45:48 2024 +0000

    Fix overread in JSON parsing errors for incomplete byte sequences
    
    json_lex_string() relies on pg_encoding_mblen_bounded() to point to the
    end of a JSON string when generating an error message, and the input it
    uses is not guaranteed to be null-terminated.
    
    It was possible to walk off the end of the input buffer by a few bytes
    when the last bytes consist of an incomplete multi-byte sequence, as
    token_terminator would point to a location defined by
    pg_encoding_mblen_bounded() rather than the end of the input.  This
    commit switches token_terminator so as the error uses data up to the
    end of the JSON input.
    
    More work should be done so as this code could rely on an equivalent of
    report_invalid_encoding() so as incorrect byte sequences can show in
    error messages in a readable form.  This requires work for at least two
    cases in the JSON parsing API: an incomplete token and an invalid escape
    sequence.  A more complete solution may be too invasive for a backpatch,
    so this is left as a future improvement, taking care of the overread
    first.
    
    A test is added on HEAD as test_json_parser makes this issue
    straight-forward to check.
    
    Note that pg_encoding_mblen_bounded() no longer has any callers.  This
    will be removed on HEAD with a separate commit, as this is proving to
    encourage unsafe coding.
    
    Author: Jacob Champion
    Discussion: https://postgr.es/m/CAOYmi+ncM7pwLS3AnKCSmoqqtpjvA8wmCdoBtKA3ZrB2hZG6zA@mail.gmail.com
    Backpatch-through: 13


 src/common/jsonapi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/common/jsonapi.c b/src/common/jsonapi.c
index 3d0fbfa7be1..8da2bdb271b 100644
--- a/src/common/jsonapi.c
+++ b/src/common/jsonapi.c
@@ -688,6 +688,7 @@ static inline JsonParseErrorType
 json_lex_string(JsonLexContext *lex)
 {
 	char	   *s;
+	char	   *const end = lex->input + lex->input_length;
 	int			len;
 	int			hi_surrogate = -1;
 
@@ -699,8 +700,8 @@ json_lex_string(JsonLexContext *lex)
 	} while (0)
 #define FAIL_AT_CHAR_END(code) \
 	do { \
-		lex->token_terminator = \
-			s + pg_encoding_mblen_bounded(lex->input_encoding, s); \
+		char	   *term = s + pg_encoding_mblen(lex->input_encoding, s); \
+		lex->token_terminator = (term <= end) ? term : end; \
 		return code; \
 	} while (0)
 


[parent: 52b23b4e1c6f]