🚑 fix for #405

nlohmann · Dec 29, 2016 · 871ceba · 871ceba
1 parent 8381cd6
commit 871ceba
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 0 deletions.
diff --git a/src/json.hpp b/src/json.hpp
@@ -6871,6 +6871,12 @@ class basic_json
  {
  throw std::out_of_range("len+offset out of range");
  }
+
+ // last case: reading past the end of the vector
+ if (len + offset > size)
+ {
+ throw std::out_of_range("len+offset out of range");
+ }
  }
 
  /*!

diff --git a/src/json.hpp.re2c b/src/json.hpp.re2c
@@ -6871,6 +6871,12 @@ class basic_json
  {
  throw std::out_of_range("len+offset out of range");
  }
+
+ // last case: reading past the end of the vector
+ if (len + offset > size)
+ {
+ throw std::out_of_range("len+offset out of range");
+ }
  }
 
  /*!

diff --git a/test/src/unit-regression.cpp b/test/src/unit-regression.cpp
@@ -540,4 +540,11 @@ TEST_CASE("regression tests")
  CHECK(j.is_number_float());
  CHECK(j.dump() == "1.66020696663386e+20");
  }
+
+ SECTION("issue #405 - Heap-buffer-overflow (OSS-Fuzz issue 342)")
+ {
+ // original test case
+ std::vector<uint8_t> vec {0x65, 0xf5, 0x0a, 0x48, 0x21};
+ CHECK_THROWS_AS(json::from_cbor(vec), std::out_of_range);
+ }
 }