CVE-2022-48623 (published 2024-02-13T05:15Z)

The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/rurban/Cpanel-JSON-XS
commit_details: repo_url: https://github.com/rurban/Cpanel-JSON-XS
author: Reini Urban
author_date: 2023-02-21 09:01:13+01:00
msg: fix decode out-of-bounds

on hash keys without :
security: could leak secrets.
Fixes GH 208
repository: repo_url: https://github.com/rurban/Cpanel-JSON-XS
repo_name: rurban/Cpanel-JSON-XS
description: Improved fork of JSON-XS
repo_language: Perl
owner: rurban
file_changes: filename: XS.xs
change_type: ModificationType.MODIFY
diff: @@ -2724,6 +2724,8 @@ decode_comment (dec_t *dec)
 INLINE void
 decode_ws (dec_t *dec)
 {
+  if (dec->cur >= dec->end)
+    return;
   for (;;)
     {
       char ch = *dec->cur;
@@ -2750,7 +2752,7 @@ decode_ws (dec_t *dec)
 
 #define ERR(reason) SB dec->err = reason; goto fail; SE
 
-#define EXPECT_CH(ch) SB \
+#define EXPECT_CH(ch) SB        \
   if (*dec->cur != ch)		\
     ERR (# ch " expected");	\
   ++dec->cur;			\
@@ -3923,7 +3925,8 @@ decode_hv (pTHX_ dec_t *dec, SV *typesv)
                       }
                     } // else overwrite it below
                   }
-                  decode_ws (dec); EXPECT_CH (':');
+                  decode_ws (dec);
+                  EXPECT_CH (':');
                   decode_ws (dec);
 
                   if (typesv)
@@ -3995,7 +3998,10 @@ decode_hv (pTHX_ dec_t *dec, SV *typesv)
                   }
 
                   dec->cur = p + 1;
-                  decode_ws (dec); if (*p != ':') EXPECT_CH (':');
+                  if (dec->cur >= dec->end)
+                    EXPECT_CH (':');
+                  decode_ws (dec);
+                  if (*p != ':') EXPECT_CH (':');
                   decode_ws (dec);
 
                   if (typesv)
@@ -4026,6 +4032,10 @@ decode_hv (pTHX_ dec_t *dec, SV *typesv)
                   break;
                 }
               ++p;
+              if (p > dec->end) {
+                dec->cur = p;
+                EXPECT_CH (':');
+              }
             }
         }
 
@@ -4485,11 +4495,16 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
   if (!sv)
     {
       SV *uni = sv_newmortal ();
-
+      COP cop = *PL_curcop;
+      if (dec.cur >= dec.end) // overshoot
+        {
+          croak ("%s, at character offset %d",
+                 dec.err,
+                 (int)ptr_to_index (aTHX_ string, dec.cur - SvPVX(string)));
+        }
 #if PERL_VERSION >= 8
       /* horrible hack to silence warning inside pv_uni_display */
       /* TODO: Can be omitted with newer perls */
-      COP cop = *PL_curcop;
       cop.cop_warnings = pWARN_NONE;
       ENTER;
       SAVEVPTR (PL_curcop);
@@ -4500,7 +4515,7 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
       croak ("%s, at character offset %d (before \"%s\")",
              dec.err,
              (int)ptr_to_index (aTHX_ string, dec.cur - SvPVX(string)),
-             dec.cur != dec.end ? SvPV_nolen (uni) : "(end of string)");
+             dec.cur < dec.end ? SvPV_nolen (uni) : "(end of string)");
     }
 
   if (!(dec.json.flags & F_ALLOW_NONREF) && json_nonref(aTHX_ sv)) {

programming_language: C