CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-09-01 11:02:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

JSON: fixed overflow detection in length calculation
Some checks are pending
buildbot / buildbot (push) Waiting to run
Details

Browse source
This commit is contained in:
Dmitry Plotnikov 2026-08-18 01:40:08 +00:00 • committed by dplotnikov-f5
parent 5f54125dde
commit 032e181dad
1 changed files with 30 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

37
src/core/ngx_json.c
View file

@ -96,10 +96,21 @@ ngx_json_obj_length(ngx_data_item_t *item)
if (i) {
for ( ;; ) {
len = sizeof("\"\":") - 1 + i->name.len
+ ngx_escape_json(NULL, i->name.data, i->name.len);
if (i->name.len > NGX_MAX_SIZE_T_VALUE - (sizeof("\"\":") - 1)) {
return NGX_ERROR;
}
if (total > NGX_MAX_SIZE_T_VALUE - len) {
len = sizeof("\"\":") - 1 + i->name.len;
if (len > NGX_MAX_SIZE_T_VALUE - total) {
return NGX_ERROR;
}
total += len;
len = ngx_escape_json(NULL, i->name.data, i->name.len);
if (len > NGX_MAX_SIZE_T_VALUE - total) {
return NGX_ERROR;
}
@ -110,7 +121,7 @@ ngx_json_obj_length(ngx_data_item_t *item)
return NGX_ERROR;
}
if (total > NGX_MAX_SIZE_T_VALUE - len) {
if (len > NGX_MAX_SIZE_T_VALUE - total) {
return NGX_ERROR;
}
@ -190,7 +201,7 @@ ngx_json_list_length(ngx_data_item_t *item)
return NGX_ERROR;
}
if (total > NGX_MAX_SIZE_T_VALUE - len) {
if (len > NGX_MAX_SIZE_T_VALUE - total) {
return NGX_ERROR;
}
@ -248,12 +259,24 @@ ngx_json_list_encode(u_char *p, ngx_data_item_t *item)
static ssize_t
ngx_json_string_length(ngx_data_item_t *item)
{
size_t len, total;
ngx_str_t *str;
str = &item->data.string;
return sizeof("\"\"") - 1 + str->len
+ ngx_escape_json(NULL, str->data, str->len);
if (str->len > NGX_MAX_SIZE_T_VALUE - (sizeof("\"\"") - 1)) {
return NGX_ERROR;
}
total = sizeof("\"\"") - 1 + str->len;
len = ngx_escape_json(NULL, str->data, str->len);
if (len > NGX_MAX_SIZE_T_VALUE - total) {
return NGX_ERROR;
}
return total + len;
}