Re: [LTP] ujson: Fix 4-byte UTF-8 sequence decoding

Re: [LTP] ujson: Fix 4-byte UTF-8 sequence decoding

[linuxtestproject.agent]

Hi Andrea,

On 5 October 2026, Andrea Cervesato wrote:
> ujson: Fix 4-byte UTF-8 sequence decoding

--- [PATCH 10/15] ---

> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> +	if (copy_str(buf, str, len))
> +		return 1;

Medium: For {"first":1,"bad\q":2}, ujson_obj_next() returns zero but leaves
res->type as UJSON_INT, id as "badst", and the previous integer value.
UJSON_OBJ_FOREACH therefore executes its body again with that stale value.
Set res->type to UJSON_VOID on ID-parsing errors in both obj_next() and
obj_next_filter().

--- [PATCH 11/15] ---

> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> +	capacity = len > 0 ? (size_t)len + 1 : 4096;

Medium: On 32-bit musl, where off_t is 64-bit, a 4 GiB - 1 byte file makes
capacity wrap to zero; doubling zero still yields zero, read(..., 0)
returns zero, and loading succeeds with an empty reader.
Reject lengths that cannot fit the allocation before narrowing to size_t,
and check the allocation additions and capacity doubling for overflow.

Verdict - Needs revision

Pre-existing issue exercised by patch 5:

> if (ujson_utf8_bytes(ucode) + 1 >= len - off) {

Medium: The new surrogate-pair path reaches this off-by-one check:
["\uD83D\uDE00"] fails with a five-byte output buffer even though the four
UTF-8 bytes and terminating NUL fit exactly.
Change >= to > so an exactly sufficient buffer is accepted.

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 00/15] Fix ujson bugs

[Andrea Cervesato]

- fix 4-byte UTF-8 sequence decoding in ujson_utf8_next()
- fix out-of-bounds read on invalid UTF-8 in ujson_writer
- prevent infinite loop when read() returns 0 in ujson_reader
- fix inverted open() error check in ujson_writer_file_open()
- return UTF-8 length when calculating string size in ujson_reader
- combine UTF-16 surrogate pairs and reject lone surrogates
- check for signed integer overflow when parsing numbers
- fix error propagation when newline() fails in ujson_writer
- check output return values in esc_flush() helper
- unescape object IDs and reset type on error in ujson_reader
- reject empty and zero-sized files in ujson_reader_load()
- reject \u0000 escape sequences in string values
- set errno when a file flush fails in ujson_writer
- advance buffer pointer on short write in ujson_writer
- flush buffered data before direct writes in ujson_writer

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Changes in v2:
- ujson: reader: Prevent infinite loop on EOF: fail load on premature
  EOF instead of accepting truncated file.
- ujson: reader: Return UTF-8 length when !str: split out UTF-8 length
  calculation when !str into separate commit before surrogate handling.
- ujson: reader: Combine UTF-16 surrogate pairs: reorder checks to
  inspect unpaired low surrogates first.
- ujson: reader: Check for signed integer overflow: assign negative
  integers with -(long)val.
- ujson: writer: Check return value in esc_flush(): replace ESC_FLUSH
  macro with esc_flush() helper function and check return values.
- ujson: reader: Do not increment depth on overflow: dropped from
  series.
- ujson: reader: Parse escape sequences in object IDs: reset res->type
  to UJSON_VOID on key parsing failure.
- ujson: reader: Reject files with zero size: reject zero-sized and
  empty files in ujson_reader_load() instead of dynamic reallocation.
- ujson: writer: Set errno when a flush fails: distinguish ret == 0
  with a dedicated error message and errno = EAGAIN.
- ujson: writer: Flush buffer before direct writes: move !buf_len
  check into out_writer_file_write().
- Link to v1: https://lore.kernel.org/20261005-fix_core_lib_deepseek-v1-0-fec334ce8e80@suse.com

---
Andrea Cervesato (15):
      ujson: Fix 4-byte UTF-8 sequence decoding
      ujson: writer: Fix OOB read on invalid UTF-8
      ujson: reader: Prevent infinite loop on EOF
      ujson: writer: Fix open() return value check
      ujson: reader: Return UTF-8 length when !str
      ujson: reader: Combine UTF-16 surrogate pairs
      ujson: reader: Check for signed integer overflow
      ujson: writer: Return error when newline() fails
      ujson: writer: Check return value in esc_flush()
      ujson: reader: Parse escape sequences in object IDs
      ujson: reader: Reject files with zero size
      ujson: reader: Reject \u0000 escape in strings
      ujson: writer: Set errno when a flush fails
      ujson: writer: Advance buffer on short write
      ujson: writer: Flush buffer before direct writes

 include/ujson_utf.h       |   6 +--
 libs/ujson/ujson_reader.c | 101 ++++++++++++++++++++++++++++++++--------------
 libs/ujson/ujson_writer.c |  75 ++++++++++++++++++++++++----------
 3 files changed, 126 insertions(+), 56 deletions(-)
---
base-commit: 07da37cf3dbda876b33ad820168a33b9deacbddb
change-id: 20260925-fix_core_lib_deepseek-2ba9018c7588

Best regards,
--  
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 01/15] ujson: Fix 4-byte UTF-8 sequence decoding

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

In ujson_utf8_next(), decoding 4-byte UTF-8 sequences read past the
byte boundary, verified the already-masked byte s2 instead of the
fourth byte s3, and failed to advance the string pointer correctly.
As a result, any 4-byte UTF-8 sequence was rejected and returned 0.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 include/ujson_utf.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/ujson_utf.h b/include/ujson_utf.h
index 83fe8ab09..801a1fcb2 100644
--- a/include/ujson_utf.h
+++ b/include/ujson_utf.h
@@ -65,15 +65,15 @@ static inline uint32_t ujson_utf8_next(const char **str)
 	if (UJSON_UTF8_IS_3BYTE(s0))
 		return (s0 & 0x0f)<<12 | s1<<6 | s2;
 
-	(*str)++;
-
 	uint32_t s3 = *str[0];
 
-	if (!UJSON_UTF8_IS_NBYTE(s2))
+	if (!UJSON_UTF8_IS_NBYTE(s3))
 		return 0;
 
 	s3 &= UJSON_UTF8_NBYTE_MASK;
 
+	(*str)++;
+
 	if (UJSON_UTF8_IS_4BYTE(s0))
 		return (s0 & 0x07)<<18 | s1<<12 | s2<<6 | s3;
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 02/15] ujson: writer: Fix OOB read on invalid UTF-8

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

ujson_utf8_next_chsz() returns -1 on invalid UTF-8 sequences.
Because i is unsigned (size_t), adding -1 moves i back by one byte.
When i > 0, the loop steps back to the previous character and then
forward onto the invalid byte again, looping forever. When i == 0
(invalid byte at the start of the string or right after an escaped
character), i wraps to SIZE_MAX, causing out-of-bounds reads in
subsequent iterations and during output flushing. Stop and set an
error when an invalid UTF-8 byte sequence is encountered.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index c86a3b2af..b5da494d1 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -114,6 +114,10 @@ static inline int out_esc_str(ujson_writer *self, const char *val)
 
 	do {
 		next_chsz = ujson_utf8_next_chsz(val, i);
+		if (next_chsz < 0) {
+			err(self, "Invalid UTF-8 sequence");
+			return 1;
+		}
 
 		if (next_chsz == 1) {
 			switch (val[i]) {

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 03/15] ujson: reader: Prevent infinite loop on EOF

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

When read() returns 0 before reaching the size reported by lseek()
(e.g. truncated files), off does not advance and the loop spins
indefinitely. Treat premature EOF as an error and fail the load.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 9f86f25b7..3cd7fcce5 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -1032,6 +1032,11 @@ ujson_reader *ujson_reader_load(const char *path)
 			goto err1;
 		}
 
+		if (res == 0) {
+			fprintf(stderr, "read() returned 0 (file was truncated?)\n");
+			goto err1;
+		}
+
 		off += res;
 	}
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 04/15] ujson: writer: Fix open() return value check

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

open() returns -1 on failure and a non-negative file descriptor on
success (including 0). Checking !writer_file->fd wrongly rejects fd 0
as an error and accepts -1 on open failure. Check for negative fd
instead.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index b5da494d1..040ae680e 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -475,7 +475,7 @@ ujson_writer *ujson_writer_file_open(const char *path)
 	writer_file = (void*)ret + sizeof(ujson_writer);
 
 	writer_file->fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0664);
-	if (!writer_file->fd) {
+	if (writer_file->fd < 0) {
 		free(ret);
 		return NULL;
 	}

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 05/15] ujson: reader: Return UTF-8 length when !str

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

When parse_ucode_esc() is called without an output buffer to calculate
string length, it returned the unicode code point instead of the UTF-8
byte length. This vastly overestimated the required buffer size. Return
the UTF-8 byte length instead.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 3cd7fcce5..6dde06e01 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -135,7 +135,7 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str,
 		return 0;
 
 	if (!str)
-		return ucode;
+		return ujson_utf8_bytes(ucode);
 
 	if (ujson_utf8_bytes(ucode) + 1 >= len - off) {
 		ujson_err(buf, "String buffer too short!");

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 06/15] ujson: reader: Combine UTF-16 surrogate pairs

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

RFC 8259 specifies that characters outside the BMP may be represented
as a surrogate pair (\uD800-\uDBFF followed by \uDC00-\uDFFF).
Currently, each \uXXXX escape is converted independently to UTF-8,
producing invalid surrogate code point sequences instead of combining
them into a single UTF-8 sequence. Lone surrogates are also improperly
accepted. Combine valid surrogate pairs and reject unpaired surrogates.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 6dde06e01..7bf5b91f2 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -134,6 +134,34 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str,
 	if (ucode < 0)
 		return 0;
 
+	if (ucode >= 0xdc00 && ucode <= 0xdfff) {
+		ujson_err(buf, "Unpaired low surrogate");
+		return 0;
+	}
+
+	if (ucode >= 0xd800 && ucode <= 0xdbff) {
+		int32_t low;
+
+		if (peekb(buf) != '\\' || peekb_off(buf, 1) != 'u') {
+			ujson_err(buf, "Unpaired high surrogate");
+			return 0;
+		}
+
+		getb(buf);
+		getb(buf);
+
+		low = parse_ucode_cp(buf);
+		if (low < 0)
+			return 0;
+
+		if (low < 0xdc00 || low > 0xdfff) {
+			ujson_err(buf, "Invalid low surrogate in escape sequence");
+			return 0;
+		}
+
+		ucode = 0x10000 + (((ucode - 0xd800) << 10) | (low - 0xdc00));
+	}
+
 	if (!str)
 		return ujson_utf8_bytes(ucode);
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 07/15] ujson: reader: Check for signed integer overflow

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

In get_int(), integers longer than LONG_MAX overflow long during
multiplication and addition, resulting in undefined behavior.
Accumulate the value in unsigned long, check against LONG_MAX or
LONG_MIN limits on each digit, and report an error on overflow.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 7bf5b91f2..890d07b35 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -11,6 +11,7 @@
 #include <string.h>
 #include <stdarg.h>
 #include <stdint.h>
+#include <limits.h>
 
 #include "ujson_utf.h"
 #include "ujson_reader.h"
@@ -311,7 +312,7 @@ static int is_digit(char b)
 
 static int get_int(ujson_reader *buf, struct ujson_val *res)
 {
-	long val = 0;
+	unsigned long val = 0;
 	int sign = 1;
 
 	if (eatb(buf, '-')) {
@@ -327,17 +328,25 @@ static int get_int(ujson_reader *buf, struct ujson_val *res)
 		return 1;
 	}
 
+	unsigned long max = (sign < 0) ? (unsigned long)LONG_MAX + 1UL : (unsigned long)LONG_MAX;
+
 	while (is_digit(peekb(buf))) {
-		val *= 10;
-		val += getb(buf) - '0';
-		//TODO: overflow?
+		unsigned int d = getb(buf) - '0';
+
+		if (val > (max - d) / 10) {
+			ujson_err(buf, "Integer overflow");
+			return 1;
+		}
+
+		val = val * 10 + d;
 	}
 
 	if (sign < 0)
-		val = -val;
+		res->val_int = -(long)val;
+	else
+		res->val_int = (long)val;
 
-	res->val_int = val;
-	res->val_float = val;
+	res->val_float = res->val_int;
 
 	return 0;
 }

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 08/15] ujson: writer: Return error when newline() fails

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

When out_ch(self, '\n') fails, newline() returns 0 instead of 1,
masking output write errors from the caller. ujson_obj_finish() and
ujson_arr_finish() also ignore the newline() return value. Return 1
on write failure and propagate it to the caller.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index 040ae680e..c203ee079 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -179,7 +179,7 @@ static int do_padd(ujson_writer *self)
 static int newline(ujson_writer *self)
 {
 	if (out_ch(self, '\n'))
-		return 0;
+		return 1;
 
 	if (do_padd(self))
 		return 1;
@@ -261,8 +261,8 @@ int ujson_obj_finish(ujson_writer *self)
 
 	clear_depth_bit(self);
 
-	if (!first)
-		newline(self);
+	if (!first && newline(self))
+		return 1;
 
 	return out_ch(self, '}');
 }
@@ -304,8 +304,8 @@ int ujson_arr_finish(ujson_writer *self)
 
 	clear_depth_bit(self);
 
-	if (!first)
-		newline(self);
+	if (!first && newline(self))
+		return 1;
 
 	return out_ch(self, ']');
 }

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 09/15] ujson: writer: Check return value in esc_flush()

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

ESC_FLUSH ignored the return values of out() and out_str(). If an
output error occurred while flushing escaped characters, the error was
ignored and writing continued. Replace ESC_FLUSH with an esc_flush()
helper function, check its return value, and propagate errors.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index c203ee079..7882a5ab5 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -97,12 +97,16 @@ static inline int out_ch(ujson_writer *self, char ch)
 	return out(self, &ch, 1);
 }
 
-#define ESC_FLUSH(esc_char) do {\
-	out(self, val, i); \
-	val += i + 1; \
-	i = 0; \
-	out_str(self, esc_char); \
-} while (0)
+static inline int esc_flush(ujson_writer *self, const char **val, size_t *i, const char *esc_char)
+{
+	if (out(self, *val, *i))
+		return 1;
+
+	*val += *i + 1;
+	*i = 0;
+
+	return out_str(self, esc_char);
+}
 
 static inline int out_esc_str(ujson_writer *self, const char *val)
 {
@@ -120,34 +124,39 @@ static inline int out_esc_str(ujson_writer *self, const char *val)
 		}
 
 		if (next_chsz == 1) {
+			int ret = 0;
+
 			switch (val[i]) {
 			case '\"':
-				ESC_FLUSH("\\\"");
+				ret = esc_flush(self, &val, &i, "\\\"");
 			break;
 			case '\\':
-				ESC_FLUSH("\\\\");
+				ret = esc_flush(self, &val, &i, "\\\\");
 			break;
 			case '/':
-				ESC_FLUSH("\\/");
+				ret = esc_flush(self, &val, &i, "\\/");
 			break;
 			case '\b':
-				ESC_FLUSH("\\b");
+				ret = esc_flush(self, &val, &i, "\\b");
 			break;
 			case '\f':
-				ESC_FLUSH("\\f");
+				ret = esc_flush(self, &val, &i, "\\f");
 			break;
 			case '\n':
-				ESC_FLUSH("\\n");
+				ret = esc_flush(self, &val, &i, "\\n");
 			break;
 			case '\r':
-				ESC_FLUSH("\\r");
+				ret = esc_flush(self, &val, &i, "\\r");
 			break;
 			case '\t':
-				ESC_FLUSH("\\t");
+				ret = esc_flush(self, &val, &i, "\\t");
 			break;
 			default:
 				i += next_chsz;
 			}
+
+			if (ret)
+				return 1;
 		} else {
 			i += next_chsz;
 		}

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 10/15] ujson: reader: Parse escape sequences in object IDs

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

copy_id_str() copied characters verbatim without handling escape
sequences, which caused escaped quotes \" to prematurely terminate
the key and left other escape sequences such as \uXXXX unparsed.
Reuse copy_str() to parse object ID strings with full escape support.

As a side effect, too long and unterminated IDs now report the generic
copy_str() errors ("String buffer too short!", "Unterminated string")
instead of the ID-specific ones. Also set res->type to UJSON_VOID on
ID-parsing errors to prevent iterating with stale values on failure.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 32 +++++++++-----------------------
 1 file changed, 9 insertions(+), 23 deletions(-)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 890d07b35..21425f848 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -258,32 +258,14 @@ static int copy_str(ujson_reader *buf, char *str, size_t len)
 
 static int copy_id_str(ujson_reader *buf, char *str, size_t len)
 {
-	size_t pos = 0;
-
 	if (eatws(buf))
 		goto err0;
 
-	if (!eatb(buf, '"'))
+	if (peekb(buf) != '"')
 		goto err0;
 
-	for (;;) {
-		if (buf_empty(buf)) {
-			ujson_err(buf, "Unterminated ID string");
-			return 1;
-		}
-
-		if (eatb(buf, '"')) {
-			str[pos] = 0;
-			break;
-		}
-
-		if (pos >= len-1) {
-			ujson_err(buf, "ID string too long");
-			return 1;
-		}
-
-		str[pos++] = getb(buf);
-	}
+	if (copy_str(buf, str, len))
+		return 1;
 
 	if (eatws(buf))
 		goto err1;
@@ -706,8 +688,10 @@ static int skip_obj_val(ujson_reader *buf)
 
 static int obj_next(ujson_reader *buf, struct ujson_val *res)
 {
-	if (copy_id_str(buf, res->id, sizeof(res->id)))
+	if (copy_id_str(buf, res->id, sizeof(res->id))) {
+		res->type = UJSON_VOID;
 		return 0;
+	}
 
 	return get_value(buf, res);
 }
@@ -732,8 +716,10 @@ static int obj_next_filter(ujson_reader *buf, struct ujson_val *res,
 	const struct ujson_obj_attr *attr;
 
 	for (;;) {
-		if (copy_id_str(buf, res->id, sizeof(res->id)))
+		if (copy_id_str(buf, res->id, sizeof(res->id))) {
+			res->type = UJSON_VOID;
 			return 0;
+		}
 
 		res->idx = obj ? ujson_obj_lookup(obj, res->id) : (size_t)-1;
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 11/15] ujson: reader: Reject files with zero size

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Empty files and pseudo-files like sysfs or procfs report a size of 0
with lseek(). An empty file is not valid JSON, and reading JSON from
pseudo-files is unsupported. Reject files with zero size in
ujson_reader_load().

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 21425f848..9d17bbf4b 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -1028,6 +1028,11 @@ ujson_reader *ujson_reader_load(const char *path)
 		goto err0;
 	}
 
+	if (!len) {
+		fprintf(stderr, "File is empty\n");
+		goto err0;
+	}
+
 	if (lseek(fd, 0, SEEK_SET) == (off_t)-1) {
 		fprintf(stderr, "lseek() failed\n");
 		goto err0;

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 12/15] ujson: reader: Reject \u0000 escape in strings

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

String values and object IDs are returned as NUL-terminated C strings.
A \u0000 escape was written as a NUL byte into the output buffer,
silently truncating the string. Report an error instead.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_reader.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
index 9d17bbf4b..dae45ebb9 100644
--- a/libs/ujson/ujson_reader.c
+++ b/libs/ujson/ujson_reader.c
@@ -135,6 +135,12 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str,
 	if (ucode < 0)
 		return 0;
 
+	/* Strings are NUL-terminated, an embedded NUL would truncate them */
+	if (!ucode) {
+		ujson_err(buf, "\\u0000 is not supported");
+		return 0;
+	}
+
 	if (ucode >= 0xdc00 && ucode <= 0xdfff) {
 		ujson_err(buf, "Unpaired low surrogate");
 		return 0;

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 13/15] ujson: writer: Set errno when a flush fails

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

ujson_writer_file_close() uses errno to decide whether flushing the
buffered data failed. out_writer_file_write() can fail without setting
errno, when write() returns 0 or more bytes than requested, so close
could report success even though data was lost. Set errno to EAGAIN or
EIO in these cases.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index 7882a5ab5..eb446749f 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -404,13 +404,20 @@ static int out_writer_file_write(ujson_writer *self, int fd, const char *buf, ss
 {
 	do {
 		ssize_t ret = write(fd, buf, buf_len);
-		if (ret <= 0) {
+		if (ret < 0) {
 			err(self, "Failed to write to a file");
 			return 1;
 		}
 
+		if (ret == 0) {
+			err(self, "The write() syscall returned 0");
+			errno = EAGAIN;
+			return 1;
+		}
+
 		if (ret > buf_len) {
 			err(self, "Wrote more bytes than requested?!");
+			errno = EIO;
 			return 1;
 		}
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 14/15] ujson: writer: Advance buffer on short write

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

On a short write(), out_writer_file_write() decremented the remaining
length but kept writing from the start of the buffer, so the beginning
of the data was written again and the output file got corrupted.
Advance the buffer pointer by the number of bytes written.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index eb446749f..ac21ab442 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -421,6 +421,7 @@ static int out_writer_file_write(ujson_writer *self, int fd, const char *buf, ss
 			return 1;
 		}
 
+		buf += ret;
 		buf_len -= ret;
 	} while (buf_len);
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2 15/15] ujson: writer: Flush buffer before direct writes

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

out_writer_file() writes chunks larger than a quarter of its buffer
directly to the file, bypassing data still sitting in the buffer. Any
string longer than 256 bytes was therefore written before the preceding
output, producing corrupted JSON. Flush the buffer first.

Fixes: c50a0e0751c8 ("libs: Vendor ujson library")
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 libs/ujson/ujson_writer.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/libs/ujson/ujson_writer.c b/libs/ujson/ujson_writer.c
index ac21ab442..7874735a1 100644
--- a/libs/ujson/ujson_writer.c
+++ b/libs/ujson/ujson_writer.c
@@ -402,6 +402,9 @@ struct json_writer_file {
 
 static int out_writer_file_write(ujson_writer *self, int fd, const char *buf, ssize_t buf_len)
 {
+	if (!buf_len)
+		return 0;
+
 	do {
 		ssize_t ret = write(fd, buf, buf_len);
 		if (ret < 0) {
@@ -434,8 +437,15 @@ static int out_writer_file(ujson_writer *self, const char *buf, size_t buf_len)
 	size_t buf_size = sizeof(writer_file->buf);
 	size_t buf_avail = buf_size - writer_file->buf_used;
 
-	if (buf_len > buf_size/4)
+	if (buf_len > buf_size / 4) {
+		if (out_writer_file_write(self, writer_file->fd,
+					  writer_file->buf, writer_file->buf_used))
+			return 1;
+
+		writer_file->buf_used = 0;
+
 		return out_writer_file_write(self, writer_file->fd, buf, buf_len);
+	}
 
 	if (buf_len >= buf_avail) {
 		if (out_writer_file_write(self, writer_file->fd,

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ujson: Fix 4-byte UTF-8 sequence decoding

[linuxtestproject.agent]

Hi Andrea,

On 13 October 2026, Andrea Cervesato wrote:
> ujson: Fix 4-byte UTF-8 sequence decoding

--- [PATCH 7/15] ---

> ujson: reader: Check for signed integer overflow
> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> +	if (sign < 0)
> +		res->val_int = -(long)val;

Medium severity: the bound allows LONG_MAX + 1 for negative input, but
-(long)val then negates LONG_MIN, causing signed overflow on both LP64 and
ILP32. Parsing [-9223372036854775808] on LP64 triggers UBSan here. Assign
LONG_MIN directly for that magnitude, or accumulate negative values without
negating LONG_MIN.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp