GNU bug report logs - #42113
28.0.50; Segmentation fault in json-parse-file

Previous Next

Full log

Message #20 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Philipp Stephani <p.stephani2 <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: Erik Hetzner <egh <at> e6h.org>, bug-gnu-emacs <at> gnu.org, 42113 <at> debbugs.gnu.org
Subject: Re: bug#42113: 28.0.50; Segmentation fault in json-parse-file
Date: Mon, 29 Jun 2020 12:07:33 +0200

Am Mo., 29. Juni 2020 um 11:39 Uhr schrieb Eli Zaretskii <eliz <at> gnu.org>:
>
> On June 29, 2020 11:33:45 AM GMT+03:00, Philipp Stephani <p.stephani2 <at> gmail.com> wrote:
> > Am So., 28. Juni 2020 um 23:53 Uhr schrieb Erik Hetzner <egh <at> e6h.org>:
> > >
> > > 1. Start emacs -Q
> > > 2. Evaluate the following
> > > (require 'dom)
> > >
> > > (with-current-buffer (url-retrieve-synchronously
> > "https://www.seriouseats.com/recipes/2020/06/florentine-omelette-spinach-and-cheese.html")
> > >         (let* ((dom (libxml-parse-html-region (point-min)
> > (point-max)))
> > >                (scripts (dom-by-tag dom 'script))
> > >                (json-lds-raw (dom-elements scripts 'type
> > "^application/ld\\+json$"))
> > >                (json-lds (mapcar #'json-parse-string
> > json-lds-raw)))))
> > >
> > > Result: segmentation fault.
> >
> > Simpler: (json-parse-string 1)
> > The JSON functions are missing CHECK_STRING in several places where
> > json_encode is called.
>
> In this specific case I think the test is there, but it is done a bit too late.  The call to check_string_without_embedded_nuls should be moved before json_encode.

Is that always guaranteed to be correct though? Is there a guarantee
that encoding can never produce null bytes that weren't already
present in the input?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.