Check for allocation errors in yajl_bs_push

brianmario · Apr 4, 2022 · 7dc47b1 · 7dc47b1
1 parent 7ab2f32
commit 7dc47b1
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/ext/yajl/yajl_bytestack.h b/ext/yajl/yajl_bytestack.h
@@ -38,9 +38,11 @@
 #ifndef __YAJL_BYTESTACK_H__
 #define __YAJL_BYTESTACK_H__
 
+#include <limits.h>
 #include "api/yajl_common.h"
 
 #define YAJL_BS_INC 128
+#define YAJL_BS_MAX_SIZE UINT_MAX
 
 typedef struct yajl_bytestack_t
 {
@@ -66,12 +68,18 @@ typedef struct yajl_bytestack_t
 #define yajl_bs_current(obs)               \
     (assert((obs).used > 0), (obs).stack[(obs).used - 1])
 
-static inline void yajl_bs_push_inline(yajl_bytestack *obs, unsigned char byte) {
+/* 0: success, 1: error */
+static inline int yajl_bs_push_inline(yajl_bytestack *obs, unsigned char byte) {
     if ((obs->size - obs->used) == 0) {
+        if (obs->size > YAJL_BS_MAX_SIZE - YAJL_BS_INC)
+            return 1;
         obs->size += YAJL_BS_INC;
         obs->stack = obs->yaf->realloc(obs->yaf->ctx, (void *)obs->stack, obs->size);
+        if (!obs->stack)
+            return 1;
     }
     obs->stack[obs->used++] = byte;
+    return 0;
 }
 
 #define yajl_bs_push(obs, byte) yajl_bs_push_inline(&(obs), (byte))

diff --git a/ext/yajl/yajl_parser.c b/ext/yajl/yajl_parser.c
@@ -328,7 +328,9 @@ yajl_do_parse(yajl_handle hand, const unsigned char * jsonText,
                 }
             }
             if (stateToPush != yajl_state_start) {
-                yajl_bs_push(hand->stateStack, stateToPush);
+                if (yajl_bs_push(hand->stateStack, stateToPush)) {
+                    return yajl_status_alloc_failed;
+                }
             }
 
             goto around_again;