From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5E2C3CA6019 for ; Fri, 9 Oct 2026 15:24:29 +0000 (UTC) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 6EED13E9E6C for ; Fri, 9 Oct 2026 17:24:27 +0200 (CEST) Received: from in-3.smtp.seeweb.it (in-3.smtp.seeweb.it [IPv6:2001:4b78:1:20::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id C784B3E9B56 for ; Fri, 9 Oct 2026 17:24:11 +0200 (CEST) Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2a07:de40:b251:101:10:150:64:2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by in-3.smtp.seeweb.it (Postfix) with ESMTPS id 51BE71A010A4 for ; Fri, 9 Oct 2026 17:24:05 +0200 (CEST) Received: from imap1.dmz-prg2.suse.org (unknown [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id C9FD21F7CB; Fri, 9 Oct 2026 15:24:02 +0000 (UTC) Authentication-Results: smtp-out2.suse.de; none Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 992B61326D; Fri, 9 Oct 2026 15:24:02 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id RmvEGxIHyWq+XgAAD6G6ig (envelope-from ); Fri, 09 Oct 2026 15:24:02 +0000 Date: Fri, 9 Oct 2026 17:24:19 +0200 From: Cyril Hrubis To: Andrea Cervesato Message-ID: References: <20261005-fix_core_lib_deepseek-v1-0-fec334ce8e80@suse.com> <20261005-fix_core_lib_deepseek-v1-12-fec334ce8e80@suse.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20261005-fix_core_lib_deepseek-v1-12-fec334ce8e80@suse.com> X-Rspamd-Pre-Result: action=no action; module=Unknown lua; unknown reason X-Rspamd-Pre-Result: action=no action; module=Unknown lua; unknown reason X-Spamd-Result: default: False [0.00 / 50.00] X-Virus-Scanned: clamav-milter 1.0.9 at in-3.smtp.seeweb.it X-Virus-Status: Clean Subject: Re: [LTP] [PATCH 12/15] ujson: reader: Reject \u0000 escape in strings X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Linux Test Project Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ltp-bounces+ltp=archiver.kernel.org@lists.linux.it Sender: "ltp" Hi! > String values and object IDs are returned as NUL-terminated C strings. > A \u0000 escape was written as a NUL byte into the output buffer, > silently truncating the string. Report an error instead. > > Fixes: c50a0e0751c8 ("libs: Vendor ujson library") > Signed-off-by: Andrea Cervesato > --- > libs/ujson/ujson_reader.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c > index dd1d96d5f..c8b8979ec 100644 > --- a/libs/ujson/ujson_reader.c > +++ b/libs/ujson/ujson_reader.c > @@ -135,6 +135,12 @@ static unsigned int parse_ucode_esc(ujson_reader *buf, char *str, > if (ucode < 0) > return 0; > > + /* Strings are NUL-terminated, an embedded NUL would truncate them */ > + if (!ucode) { > + ujson_err(buf, "\\u0000 is not supported"); > + return 0; > + } > + > if (ucode >= 0xd800 && ucode <= 0xdbff) { > int32_t low; Reviewed-by: Cyril Hrubis -- Cyril Hrubis chrubis@suse.cz -- Mailing list info: https://lists.linux.it/listinfo/ltp