WeaselJsonParser_parse does not validate that len is non-negative. It directly computes buf + len (in src/parser3.h, Parser3::parse) and uses the result as bufEnd. Passing a negative len is undefined behavior in C++ and can cause the parser to read memory before the supplied buffer.
Affected file: src/lib.cpp / src/parser3.h
src/lib.cpp lines 42–45: the public WeaselJsonParser_parse forwards len to Parser3::parse without a range check.
src/parser3.h lines 1076 and 1085 (Parser3::parse): buf + len is formed immediately and used as bufEnd by every continuation.
Reproduction (undefined behavior, observed to return REJECT on one run but could crash or read out of bounds depending on the pointer/value):
WeaselJsonCallbacksc={/* all no-ops */};WeaselJsonParser*p=WeaselJsonParser_create(1024,&c,NULL,0);charbuf[10]="hello";WeaselJsonStatuss=WeaselJsonParser_parse(p,buf,-1);// s may be REJECT by accident, but the computation buf + (-1) is UB.
Expected behavior: WeaselJsonParser_parse should return WeaselJson_REJECT (or at least not invoke undefined behavior) when len < 0.
Actual behavior:
The function forms buf + len with a negative offset and continues parsing, which is undefined and may read out-of-bounds memory.
`WeaselJsonParser_parse` does not validate that `len` is non-negative. It directly computes `buf + len` (in `src/parser3.h`, `Parser3::parse`) and uses the result as `bufEnd`. Passing a negative `len` is undefined behavior in C++ and can cause the parser to read memory before the supplied buffer.
Affected file: `src/lib.cpp` / `src/parser3.h`
- `src/lib.cpp` lines 42–45: the public `WeaselJsonParser_parse` forwards `len` to `Parser3::parse` without a range check.
- `src/parser3.h` lines 1076 and 1085 (`Parser3::parse`): `buf + len` is formed immediately and used as `bufEnd` by every continuation.
Reproduction (undefined behavior, observed to return `REJECT` on one run but could crash or read out of bounds depending on the pointer/value):
```c
WeaselJsonCallbacks c = { /* all no-ops */ };
WeaselJsonParser *p = WeaselJsonParser_create(1024, &c, NULL, 0);
char buf[10] = "hello";
WeaselJsonStatus s = WeaselJsonParser_parse(p, buf, -1);
// s may be REJECT by accident, but the computation buf + (-1) is UB.
```
Expected behavior:
`WeaselJsonParser_parse` should return `WeaselJson_REJECT` (or at least not invoke undefined behavior) when `len < 0`.
Actual behavior:
The function forms `buf + len` with a negative offset and continues parsing, which is undefined and may read out-of-bounds memory.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
WeaselJsonParser_parsedoes not validate thatlenis non-negative. It directly computesbuf + len(insrc/parser3.h,Parser3::parse) and uses the result asbufEnd. Passing a negativelenis undefined behavior in C++ and can cause the parser to read memory before the supplied buffer.Affected file:
src/lib.cpp/src/parser3.hsrc/lib.cpplines 42–45: the publicWeaselJsonParser_parseforwardslentoParser3::parsewithout a range check.src/parser3.hlines 1076 and 1085 (Parser3::parse):buf + lenis formed immediately and used asbufEndby every continuation.Reproduction (undefined behavior, observed to return
REJECTon one run but could crash or read out of bounds depending on the pointer/value):Expected behavior:
WeaselJsonParser_parseshould returnWeaselJson_REJECT(or at least not invoke undefined behavior) whenlen < 0.Actual behavior:
The function forms
buf + lenwith a negative offset and continues parsing, which is undefined and may read out-of-bounds memory.I guess add as a precondition that
len >= 0and[buf, buf + len)is addressable (and writable if WeaselJsonRaw is not set)