🐛 fixing #575

I forgot to consider the offset.
nlohmann · May 7, 2017 · fba1bcd · fba1bcd
1 parent 56ac790
commit fba1bcd
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/src/json.hpp b/src/json.hpp
@@ -8915,7 +8915,7 @@ class basic_json
         {
             // avoid reading too many characters
             const size_t max_length = static_cast<size_t>(limit - start);
-            return std::string(start + offset, std::min({length, max_length}));
+            return std::string(start + offset, std::min({length, max_length - offset}));
         }
 
       private:

diff --git a/test/src/unit-regression.cpp b/test/src/unit-regression.cpp
@@ -1010,4 +1010,10 @@ TEST_CASE("regression tests")
         CHECK(not(6 <= j["a"]));
         CHECK(not(6 <  j["a"]));
     }
+
+    SECTION("issue #575 - heap-buffer-overflow (OSS-Fuzz 1400)")
+    {
+        std::vector<uint8_t> vec = {'"', '\\', '"', 'X', '"', '"'};
+        CHECK_THROWS_AS(json::parse(vec), json::parse_error);
+    }
 }