Azure / azure-sdk-for-c

This repository is for active development of the Azure SDK for Embedded C. For consumers of the SDK we recommend visiting our versioned developer docs at https://azure.github.io/azure-sdk-for-c.

MIT License

226 stars 120 forks source link

Fail gracefully on invalid/incomplete JSON payload processing containing \uXXXX characters #1352

Closed ahsonkhan closed 4 years ago

ahsonkhan commented 4 years ago

Broken off from https://github.com/Azure/azure-sdk-for-c/issues/717

Currently, for incomplete/invalid JSON payloads, this will access memory we shouldn't have access to: https://github.com/Azure/azure-sdk-for-c/blob/9f6d569ded33c626b98d4512a54851c90e3ec671/sdk/src/azure/core/az_json_reader.c#L294-L312

Also add tests, along with variations to improve test coverage.

ahsonkhan commented 4 years ago

cc @hihigupt

hihigupt commented 4 years ago

Following are some of json input that reader is causing the crash:

[json_reader_crashes.zip](https://github.com/Azure/azure-sdk-for-c/files/5295651/json_reader_crashes.zip)

One of the stack trace is following, but almost all of these crashes happen at az_json_reader.c:306. `

0 0x565a3fc7 in _az_json_reader_process_string /home/higupt/gitroot/netx/netxduo/addons/azure_iot/azure-sdk-for-c/sdk/src/azure/core/az_json_reader.c:306

1 0x565af33c in _az_json_reader_process_property_name /home/higupt/gitroot/netx/netxduo/addons/azure_iot/azure-sdk-for-c/sdk/src/azure/core/az_json_reader.c:365

2 0x565af33c in _az_json_reader_process_next_byte /home/higupt/gitroot/netx/netxduo/addons/azure_iot/azure-sdk-for-c/sdk/src/azure/core/az_json_reader.c:860

3 0x565af33c in az_json_reader_next_token /home/higupt/gitroot/netx/netxduo/addons/azure_iot/azure-sdk-for-c/sdk/src/azure/core/az_json_reader.c:946

4 0x565bd587 in nx_azure_iot_json_reader_next_token /home/higupt/gitroot/netx/netxduo/addons/azure_iot/nx_azure_iot_json_reader.c:118

5 0x5659e398 in test_read_json /home/higupt/gitroot/netx/nx_secure_internal/Test/Fuzz/azure_iot/azure_iot_process_json_reader_test.c:39

6 0x5659d0f0 in main /home/higupt/gitroot/netx/nx_secure_internal/Test/Fuzz/azure_iot/azure_iot_process_json_reader_test.c:180

7 0xf77efe90 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18e90)

8 0x5659dffe (/home/higupt/gitroot/netx/nx_secure_internal/Test/Fuzz/build/azure_iot_process_json_reader_chunked_test+0x2ffe)

`