esprfid / esp-rfid

ESP8266 RFID (RC522, PN532, Wiegand, RDM6300) Access Control system featuring WebSocket, JSON, NTP Client, Javascript, SPIFFS
MIT License
1.33k stars 417 forks source link

don't process JSON past the end of the buffer #619

Closed mcnewton closed 3 months ago

mcnewton commented 3 months ago

The buffer that files are read into is not zero-terminated, but deserializeJson needs a zero-terminated string. It seems that deserializeJson normally stops when it's read a full JSON document hence it usually works fine, but it's possible (especially if a file is corrupt for some reason) that it could keep processing past the end of the file. deserialiseJson accepts an optional buffer size which saves having to extend the buffer for the extra \0 char.

There are some other cases of deserializeJson, but having looked at them it seems to me that they are operating on zero-terminated buffers, so are good as-is.

matjack1 commented 3 months ago

Thanks!