rafagafe / json-maker Goto Github PK

Hi,

Thanks for publishing this library! I have just been looking at using it in an embedded project, but it seems that when constructing json objects, it is possible to overrun the string buffer without knowing. Perhaps it is worth adding an argument (or a series of “_s” suffixed methods) which take an additional length parameter and checks that the length of the string does not increase beyond the allocated buffer length ?

PR #5 introduced an API change that hasn't been reflected onto the tests codebase, resulting in failing build.

@Caleb-Daniels-SFC

Hi! How do I set the output format for double? Example of how this is set for sprintf "%3.6f"

Thanks for the great software!
During integration I found some inconsistencies when adding numbers to the json string.
The remLen variable did not update on the length of the number.

Changing json_num in the following manner seems to fix this:

#define json_num( funcname, type, fmt )
char* funcname( char* dest, char const* name, type value, size_t* remLen ) {
dest = primitivename( dest, name, remLen );
int len = snprintf( dest, *remLen, fmt, value );
dest += len;
*remLen -= len;
dest = chtoa( dest, ',', remLen );
return dest;
}

all the best,
Mike

Does the solidus character needs to be escaped?
Per the rfc https://www.ietf.org/rfc/rfc4627.txt

All Unicode characters may be placed within the
quotation marks except for the characters that must be escaped:
quotation mark, reverse solidus, and the control characters (U+0000
through U+001F).

the solidus doesn't require mandatorily to be escaped. So is it really required ?

prototype in json-maker.h is
char* json_objOpen( char* dest, char const* name, size_t* remLen );

but the sample code is...
dest = json_objOpen( dest, name );

also noticed the code looked suspiciously reactionary to buffer overflow at...

   char buff[512];
    int len = data_to_json( buff, &data );
    if( len >= sizeof buff ) {
        fprintf( stderr, "%s%d%s%d\n", "Error. Len: ", len, " Max: ", (int)sizeof buff - 1 );
        return EXIT_FAILURE;
    }

betting that issue was fixed, but the sample code wasn't updated.