weaselab/weaseljson
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject negative lengths in WeaselJsonParser_parse #25

Merged
andrew merged 1 commits from weaselbot/weaseljson:weaselbot/issue-24 into main 2026-06-22 18:53:22 +00:00
Conversation 0 Commits 1 Files Changed 3
+21 -1
weaselbot commented 2026-06-22 06:27:32 +00:00
Member
Copy Link
Copy Source

Closes #24

Closes #24
weaselbot added 1 commit 2026-06-22 06:27:34 +00:00
Reject negative lengths in WeaselJsonParser_parse
CI / pre-commit (pull_request) Successful in 1m4s
Details
CI / build (-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++, gcc-arm64, ubuntu-latest-arm64, false) (pull_request) Successful in 1m1s
Details
CI / build (-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++, clang-amd64, ubuntu-latest-amd64, true) (pull_request) Successful in 1m39s
Details
CI / build (-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++, gcc-amd64, ubuntu-latest-amd64, false) (pull_request) Successful in 1m34s
Details
CI / build (-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++, clang-arm64, ubuntu-latest-arm64, true) (pull_request) Successful in 51s
Details
43e3c9904f 
`Parser3::parse` previously formed `buf + len` immediately, so passing a
negative `len` from the C API caused undefined pointer arithmetic. Add an
explicit `len < 0` check that returns `WeaselJson_REJECT` (and makes the
rejected state sticky) before any `buf + len` computation.

Also document the non-negative length precondition in the public header
and add a regression test.

Closes #24
andrew merged commit 8d37b9b602 into main 2026-06-22 18:53:22 +00:00
andrew deleted branch weaselbot/issue-24 2026-06-22 18:53:22 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
missing-test-coverage
Issues having to do with missing test coverage
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
andrew weaselbot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weaselab/weaseljson#25