WeaselJsonParser_parse accepts negative len, causing undefined behavior #24

Closed
opened 2026-06-21 17:24:22 +00:00 by weaselbot · 1 comment
Member

WeaselJsonParser_parse does not validate that len is non-negative. It directly computes buf + len (in src/parser3.h, Parser3::parse) and uses the result as bufEnd. Passing a negative len is undefined behavior in C++ and can cause the parser to read memory before the supplied buffer.

Affected file: src/lib.cpp / src/parser3.h

  • src/lib.cpp lines 42–45: the public WeaselJsonParser_parse forwards len to Parser3::parse without a range check.
  • src/parser3.h lines 1076 and 1085 (Parser3::parse): buf + len is formed immediately and used as bufEnd by every continuation.

Reproduction (undefined behavior, observed to return REJECT on one run but could crash or read out of bounds depending on the pointer/value):

WeaselJsonCallbacks c = { /* all no-ops */ };
WeaselJsonParser *p = WeaselJsonParser_create(1024, &c, NULL, 0);
char buf[10] = "hello";
WeaselJsonStatus s = WeaselJsonParser_parse(p, buf, -1);
// s may be REJECT by accident, but the computation buf + (-1) is UB.

Expected behavior:
WeaselJsonParser_parse should return WeaselJson_REJECT (or at least not invoke undefined behavior) when len < 0.

Actual behavior:
The function forms buf + len with a negative offset and continues parsing, which is undefined and may read out-of-bounds memory.

`WeaselJsonParser_parse` does not validate that `len` is non-negative. It directly computes `buf + len` (in `src/parser3.h`, `Parser3::parse`) and uses the result as `bufEnd`. Passing a negative `len` is undefined behavior in C++ and can cause the parser to read memory before the supplied buffer. Affected file: `src/lib.cpp` / `src/parser3.h` - `src/lib.cpp` lines 42–45: the public `WeaselJsonParser_parse` forwards `len` to `Parser3::parse` without a range check. - `src/parser3.h` lines 1076 and 1085 (`Parser3::parse`): `buf + len` is formed immediately and used as `bufEnd` by every continuation. Reproduction (undefined behavior, observed to return `REJECT` on one run but could crash or read out of bounds depending on the pointer/value): ```c WeaselJsonCallbacks c = { /* all no-ops */ }; WeaselJsonParser *p = WeaselJsonParser_create(1024, &c, NULL, 0); char buf[10] = "hello"; WeaselJsonStatus s = WeaselJsonParser_parse(p, buf, -1); // s may be REJECT by accident, but the computation buf + (-1) is UB. ``` Expected behavior: `WeaselJsonParser_parse` should return `WeaselJson_REJECT` (or at least not invoke undefined behavior) when `len < 0`. Actual behavior: The function forms `buf + len` with a negative offset and continues parsing, which is undefined and may read out-of-bounds memory.
Owner

I guess add as a precondition that len >= 0 and [buf, buf + len) is addressable (and writable if WeaselJsonRaw is not set)

I guess add as a precondition that `len >= 0` and `[buf, buf + len)` is addressable (and writable if WeaselJsonRaw is not set)
weaselbot was assigned by andrew 2026-06-22 00:52:14 +00:00
Sign in to join this conversation.
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weaselab/weaseljson#24