🐛 fixing #575

I forgot to consider the offset.
parent 56ac7908
......@@ -8915,7 +8915,7 @@ class basic_json
{
// avoid reading too many characters
const size_t max_length = static_cast<size_t>(limit - start);
return std::string(start + offset, std::min({length, max_length}));
return std::string(start + offset, std::min({length, max_length - offset}));
}
private:
......
......@@ -1010,4 +1010,10 @@ TEST_CASE("regression tests")
CHECK(not(6 <= j["a"]));
CHECK(not(6 < j["a"]));
}
SECTION("issue #575 - heap-buffer-overflow (OSS-Fuzz 1400)")
{
std::vector<uint8_t> vec = {'"', '\\', '"', 'X', '"', '"'};
CHECK_THROWS_AS(json::parse(vec), json::parse_error);
}
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment