Project: json-c (json-c/json-c), language: c++
Vulnerability instance: json-c.cve-2021-32292
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/json-c/json-c/issues/654
## Description:
Issue: json-c/json-c#654
Title: A stack-buffer-overflow in json_parse.c:89:44
State: closed
Created by: seviezhou
Created at: 2020-08-05 02:18:37+00:00

Issue Body:
## System info

Ubuntu X64, clang 6.0, json_parse (latest master [56a89f](https://github.com/json-c/json-c/commit/56a89f902f360c91a80ac0c7419d2ba1aa8e8634))

## Configure

cmake ..-DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" 

## Command line

./build/apps/json_parse -n ./stack-overflow-parseit-json_parse-89

## AddressSanitizer output

```
=================================================================
==12668==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffea9c409b0 at pc 0x00000051747b bp 0x7ffea9c388b0 sp 0x7ffea9c388a8
READ of size 1 at 0x7ffea9c409b0 thread T0
    #0 0x51747a in parseit /home/seviezhou/jsonc/apps/json_parse.c:89:44
    #1 0x51747a in main /home/seviezhou/jsonc/apps/json_parse.c:182
    #2 0x7fc02a77783f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291
    #3 0x41a928 in _start (/home/seviezhou/jsonc/build/apps/json_parse+0x41a928)

Address 0x7ffea9c409b0 is located in stack of thread T0 at offset 33008 in frame
    #0 0x51651f in main /home/seviezhou/jsonc/apps/json_parse.c:159

  This frame has 3 object(s):
    [32, 176) 'rusage.i.i.i' (line 42)
    [240, 33008) 'buf.i' (line 52) <== Memory access at offset 33008 overflows this variable
    [33264, 33408) 'rusage.i' (line 42)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/seviezhou/jsonc/apps/json_parse.c:89:44 in parseit
Shadow bytes around the buggy address:
  0x1000553800e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000553800f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100055380100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100055380110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100055380120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100055380130: 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x100055380140: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x100055380150: f2 f2 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x100055380160: f8 f8 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f3 f3 f3 f3
  0x100055380170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100055380180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12668==ABORTING
```

## POC

[stack-overflow-parseit-json_parse-89.zip](https://github.com/json-c/json-c/files/5025755/stack-overflow-parseit-json_parse-89.zip)



Comments:
Comment by MarcT512 on 2020-08-07 09:57:31+00:00:
This is a read past end of buffer issue in the json_parse test app, which happened because your test data is malformed json.
It's not an issue with the library itself.

I created a PR with a 1 line fix that prevents the issue in json_parse.

---

Comment by seviezhou on 2020-08-07 10:30:53+00:00:
I understand that, it is not a big issue. Maybe you can close this issue.

---

Comment by MarcT512 on 2020-08-07 12:49:25+00:00:
It's a genuine issue and I'm sure the maintainers will appreciate the bug report (and hopefully the fix).
It was an interesting diversion for me to troubleshoot.

---

Comment by seviezhou on 2020-08-07 12:58:30+00:00:
Glad to hear that you are appreciate with the bug report! If I find other issues, I will inform you.

---

Comment by hawicz on 2020-08-07 14:19:02+00:00:
Thanks for the fix.

Attachments:
https://github.com/json-c/json-c/files/5025755/stack-overflow-parseit-json_parse-89.zip

Commit References:
56a89f902f360c91a80ac0c7419d2ba1aa8e8634

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p json-c-build
cmake -DBUILD_SHARED_LIBS=OFF ..
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake
RUN git clone https://github.com/json-c/json-c json-c
RUN git -C json-c checkout 9021cdcdd01fc9dbcbe1f06391848c2ac915212f
WORKDIR $SRC/json-c
COPY build.sh $SRC/

Additional files:
filename: tokener_parse_ex_fuzzer.cc
content: #include <stdint.h>

#include <json.h>

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  const char *data1 = reinterpret_cast<const char *>(data);
  json_tokener *tok = json_tokener_new();
  json_object *obj = json_tokener_parse_ex(tok, data1, size);

  json_object_put(obj);
  json_tokener_free(tok);
  return 0;
}

filename: tokener_parse_ex_fuzzer.dict
content: "{"
"}"
","
"["
"]"
","
":"
"e"
"e+"
"e-"
"E"
"E+"
"E-"
"\""
"null"
"1"
"1.234"
"3e4"