prettify_json("\"") invokes memcpy on nullptr in dump.hpp about glaze HOT 8 CLOSED

glz::prettify_json and glz::minify_json were designed to be invoked on valid input. I should probably rename them to glz::prettify_json_unsafe and glz::minify_json_unsafe and then make safe versions for the future. But, I think it would be better for users to have just a single API.

I'll work on making these safe for untrusted inputs and renaming them to _unsafe if the performance impact is greater than 2X slower.

from glaze.

I've realized revisiting the code that I had intended to make it work with untrusted input and there were a lot of checks. I've addressed this issue in #1179

Please continue to report safety issues for these functions as you find them. Thanks!

from glaze.

prettify works for this input now, but minify doesn't. So I think the fix is insufficient.

I get:

/home/pauldreik/code/delaktig/glaze/include/glaze/util/dump.hpp:135:37: runtime error: null pointer passed as argument 2, which is declared to never be null

This uses 92b8b86

from glaze.

Thanks, I added a unit test for this and will merge a fix in #1184

from glaze.

Now, minify has an out of bounds read on "\" " at

==258627==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5030000001d3 at pc 0x5653e0275c16 bp 0x7ffd757fbef0 sp 0x7ffd757fb6b0
READ of size 8 at 0x5030000001d3 thread T0
#0 0x5653e0275c15 in __asan_memcpy (/home/pauldreik/code/delaktig/glaze/out/build/clang_18/fuzzing/fuzz_json_minify+0x10cc15) (BuildId: 29a68fb9c082e34e26be672cdb4ab16dd14ad737)
#1 0x5653e02cdae3 in std::basic_string_view<char, std::char_traits> glz::detail::read_json_string<glz::opts{10u, (unsigned char)0, (unsigned char)1, (unsigned char)1, (unsigned char)1, (unsigned char)0, (unsigned char)0, (char)32, (unsigned char)3, (unsigned char)1, (unsigned char)0, (unsigned char)1, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (glz::float_precision)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)0, (unsigned char)1, (unsigned char)0, (unsigned char)0, (unsigned char)1, (unsigned char)1, 32u}, char const*&, char const*&>(char const*&, char const*&) /home/pauldreik/code/delaktig/glaze/include/glaze/json/json_format.hpp:76:10

from glaze.

Oops, I missed setting a flag for padding. Will merge a fix in #1187

from glaze.

both prettify and minify seem to be "fuzz clean" with the latest fix. great!

from glaze.

Yay! Thanks so much for your help making these safe.

from glaze.