admin/simdjson-simdjson
1
0
Fork 0
mirror of https://github.com/simdjson/simdjson synced 2026-06-08 17:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

overflow patch.

Browse Source
This commit is contained in:
Daniel Lemire
2026-05-06 17:28:39 -04:00
parent 65e59ccf9b
commit f01641e463
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/simdjson/generic/builder/json_string_builder-inl.h
+11
View File
@@ -1,5 +1,6 @@
#include <array>
#include <cstring>
#include <limits>
#include <type_traits>
#ifndef SIMDJSON_GENERIC_STRING_BUILDER_INL_H
@@ -755,6 +756,11 @@ simdjson_inline void string_builder::append(number_type v) noexcept {
simdjson_inline void
string_builder::escape_and_append(std::string_view input) noexcept {
// escaping might turn a control character into \x00xx so 6 characters.
// Guard against size_t overflow in the multiplication below.
if (input.size() > (std::numeric_limits<size_t>::max)() / 6) {
set_valid(false);
return;
}
if (capacity_check(6 * input.size())) {
position += write_string_escaped(input, buffer.get() + position);
}
@@ -763,6 +769,11 @@ string_builder::escape_and_append(std::string_view input) noexcept {
simdjson_inline void
string_builder::escape_and_append_with_quotes(std::string_view input) noexcept {
// escaping might turn a control character into \x00xx so 6 characters.
// Guard against size_t overflow in the arithmetic below.
if (input.size() > ((std::numeric_limits<size_t>::max)() - 2) / 6) {
set_valid(false);
return;
}
if (capacity_check(2 + 6 * input.size())) {
buffer.get()[position++] = '"';
position += write_string_escaped(input, buffer.get() + position);