-
Notifications
You must be signed in to change notification settings - Fork 7.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bug report about application cJSON parse (IDFGH-13276) #14207
Labels
Resolution: Won't Do
This will not be worked on
Status: Done
Issue is done internally
Type: Bug
bugs in IDF
Comments
Most likely this should be forwarded to https://github.com/DaveGamble/cJSON which maintains the cJSON library that is picked up as-is here. |
Thanks for the advice. |
3 tasks
Closing in favour of DaveGamble/cJSON#875 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Resolution: Won't Do
This will not be worked on
Status: Done
Issue is done internally
Type: Bug
bugs in IDF
Answers checklist.
IDF version.
v5.4-dev-78-gd4cd437ede-dirty
Espressif SoC revision.
ESP-WROVER-KIT V4.1
Operating System used.
Linux
How did you build your project?
Command line with idf.py
If you are using Windows, please specify command line type.
None
Development Kit.
ESP32-Wrover-Kit v2 | qemu
Power Supply used.
USB
What is the expected behavior?
The program should execute without any memory errors or crashes.
What is the actual behavior?
The program crashes with an unhandled exception indicating an illegal memory access error.
Steps to reproduce.
While fuzz testing FreeRTOS using Syzkaller, I encountered an illegal memory access error in the
cJSON
module.this is my SPEC which can trigger the bug
Debug Logs.
During the fuzzing process, I received the following error report:
It appears there is an illegal access at
components/json/cJSON/cJSON.c
in thecJSON_ParseWithOpts
function. The specific error occurs on this linebuffer_length = strlen(value) sizeof("");
If the value string is pointing to an illegal memory address, then an illegal memory access occurs whenstrlen()
is called. So in this function you should first determine if the pointer is pointing to the correct memory address, and then call thestrlen()
function.More Information.
It appears there is an illegal access at
components/json/cJSON/cJSON.c
in thecJSON_ParseWithOpts
function. The specific error occurs on this linebuffer_length = strlen(value) sizeof("");
If the value string is pointing to an illegal memory address, then an illegal memory access occurs whenstrlen()
is called. So in this function you should first determine if the pointer is pointing to the correct memory address, and then call thestrlen()
function.The text was updated successfully, but these errors were encountered: