Closed huamuyichun closed 1 month ago
Most likely this should be forwarded to https://github.com/DaveGamble/cJSON which maintains the cJSON library that is picked up as-is here.
Most likely this should be forwarded to https://github.com/DaveGamble/cJSON which maintains the cJSON library that is picked up as-is here.
Thanks for the advice.
Closing in favour of https://github.com/DaveGamble/cJSON/issues/875
Answers checklist.
IDF version.
v5.4-dev-78-gd4cd437ede-dirty
Espressif SoC revision.
ESP-WROVER-KIT V4.1
Operating System used.
Linux
How did you build your project?
Command line with idf.py
If you are using Windows, please specify command line type.
None
Development Kit.
ESP32-Wrover-Kit v2 | qemu
Power Supply used.
USB
What is the expected behavior?
The program should execute without any memory errors or crashes.
What is the actual behavior?
The program crashes with an unhandled exception indicating an illegal memory access error.
Steps to reproduce.
The program encounters an illegal memory access during the parsing process. While fuzz testing FreeRTOS using Syzkaller, I encountered an illegal memory access error in the
cJSON
module. this is my SPEC which can trigger the bugDebug Logs.
During the fuzzing process, I received the following error report:
It appears there is an illegal access at
components/json/cJSON/cJSON.c
in thecJSON_ParseWithOpts
function. The specific error occurs on this linebuffer_length = strlen(value) + sizeof("");
If the value string is pointing to an illegal memory address, then an illegal memory access occurs whenstrlen()
is called. So in this function you should first determine if the pointer is pointing to the correct memory address, and then call thestrlen()
function.More Information.
It appears there is an illegal access at
components/json/cJSON/cJSON.c
in thecJSON_ParseWithOpts
function. The specific error occurs on this linebuffer_length = strlen(value) + sizeof("");
If the value string is pointing to an illegal memory address, then an illegal memory access occurs whenstrlen()
is called. So in this function you should first determine if the pointer is pointing to the correct memory address, and then call thestrlen()
function.