diff options
| author | Maxime Coste <mawww@kakoune.org> | 2018-02-20 07:41:44 +1100 |
|---|---|---|
| committer | Maxime Coste <mawww@kakoune.org> | 2018-02-20 07:42:10 +1100 |
| commit | fec34c3748a18ce203f9f63bd014eb75d7490b0f (patch) | |
| tree | 0acc842831b5da1b8b03a1fe65189358c2e358de /src/json_ui.cc | |
| parent | 9755f7f8f28402476a3b43fe29fa51425acafd67 (diff) | |
Json: Fix buffer overflow when reading json finishing with { or [
Fixes #1860
Diffstat (limited to 'src/json_ui.cc')
| -rw-r--r-- | src/json_ui.cc | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/json_ui.cc b/src/json_ui.cc index 962ef693..01d95f9c 100644 --- a/src/json_ui.cc +++ b/src/json_ui.cc @@ -296,7 +296,9 @@ parse_json(const char* pos, const char* end) if (*pos == '[') { JsonArray array; - if (*++pos == ']') + if (++pos == end) + throw runtime_error("unable to parse array"); + if (*pos == ']') return Result{std::move(array), pos+1}; while (true) @@ -319,8 +321,10 @@ parse_json(const char* pos, const char* end) } if (*pos == '{') { + if (++pos == end) + throw runtime_error("unable to parse object"); JsonObject object; - if (*++pos == '}') + if (*pos == '}') return Result{std::move(object), pos+1}; while (true) |