@@ -1,3 +1,10 @@
1+-- WARNING: This file is security sensitive as it uses unsafeWrite which does
2+-- not check bounds. Any changes should be made with care and I would love to
3+-- get informed about them, just cc me in any PR targetting this file: @eskimor
4+-- I would be happy to review the changes!
5+
6+-- The security check at the end (pos > length) only works if pos grows
7+-- monotonously, if this condition does not hold, the check is flawed.
18module Data.Aeson.Parser.UnescapePure
29 (
310 unescapeText
@@ -145,8 +152,8 @@ unescapeText' bs = runText $ \done -> do
145152 dest <- A.new len
146153 (pos, finalState) <- B.foldl' (f' dest) (return (0, StateNone)) bs
147154
148− -- Check final state.
149− when ( finalState /= StateNone)
155+ -- Check final state. Currently pos gets only increased over time, so this check should catch overflows.
156+ when ( finalState /= StateNone || pos > len)
150157 throwDecodeError
151158
152159 done dest pos -- TODO: pos, pos-1??? XXX
@@ -248,8 +255,6 @@ unescapeText' bs = runText $ \done -> do
248255
249256 {-# INLINE f #-}
250257
251−{-# INLINE unescapeText' #-}
252−
253258write :: A.MArray s -> Int -> Word16 -> ST s ()
254259write dest pos char =
255260 A.unsafeWrite dest pos char