aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.0.1602: crash in parsing JSON

Browse Source 
Problem:    Crash in parsing JSON.
Solution:   Fail when using array or dict as dict key. (Damien)
This commit is contained in:
Bram Moolenaar
2018-03-13 13:10:41 +01:00
parent ff1e879577
commit 625f0c1eb7
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/json.c
View File

@@ -621,7 +621,9 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
if (top_item != NULL && top_item->jd_type == JSON_OBJECT_KEY
&& (options & JSON_JS)
&& reader->js_buf[reader->js_used] != '"'
&& reader->js_buf[reader->js_used] != '\'')
&& reader->js_buf[reader->js_used] != '\''
&& reader->js_buf[reader->js_used] != '['
&& reader->js_buf[reader->js_used] != '{')
{
char_u *key;
@@ -642,6 +644,11 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
switch (*p)
{
case '[': /* start of array */
if (top_item && top_item->jd_type == JSON_OBJECT_KEY)
{
retval = FAIL;
break;
}
if (ga_grow(&stack, 1) == FAIL)
{
retval = FAIL;
@@ -668,6 +675,11 @@ json_decode_item(js_read_T *reader, typval_T *res, int options)
continue;
case '{': /* start of object */
if (top_item && top_item->jd_type == JSON_OBJECT_KEY)
{
retval = FAIL;
break;
}
if (ga_grow(&stack, 1) == FAIL)
{
retval = FAIL;