JSON: Fix string parsing when \\ escape is at the end of buffer

This would have resulted in reading one octet past the end of the buffer
before rejecting the string.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/utils/json.c b/src/utils/json.c
index c6ada05480874dd07368f30524131f0c05a0c868..b64433959ff7ba9dcfbee5e1732a1de8a32c3a44 100644 (file)
--- a/src/utils/json.c
+++ b/src/utils/json.c
@@ -103,6 +103,11 @@ static char * json_parse_string(const char **json_pos, const char *end)
                        return str;
                case '\\':
                        pos++;
+                       if (pos >= end) {
+                               wpa_printf(MSG_DEBUG,
+                                          "JSON: Truncated \\ escape");
+                               goto fail;
+                       }
                        switch (*pos) {
                        case '"':
                        case '\\':