gpgme/src/cJSON.c, branch gpgme-1.14-base

json: Print "nan", "-inf", "inf" if needed.

2019-06-04T08:56:48Z

* src/cJSON.c (print_number): Print NaN and INF. -- GnuPG-bug-id: 4328 Signed-off-by: Werner Koch

json: Improve handling of large exponents in the JSON parsor.

2019-06-04T08:42:40Z

* src/cJSON.c: Include stdint.h. (parse_number): Avoid overflob in SUBSCALE and cap integer values. -- GnuPG-bug-id: 4330 Signed-off-by: Werner Koch

json: Limit recursion depth

2019-02-27T13:27:47Z

* src/cJSON.c (MAX_DEPTH): New. Maximum recursion depth. (parse_value, parse_array, parse_object): Carry and check depth argument. (cJSON_ParseWithOpts): Initialize depth. -- This fixes a stack overflow if we get weird recursive json data. GnuPG-Bug-Id: T4331

core: Silence newer compiler warnings.

2018-12-17T15:47:27Z

* configure.ac: Add -Wno-format-truncation and -Wno-sizeof-pointer-div. * src/b64dec.c (_gpgme_b64dec_proc): Add fallthrough annotation. * src/cJSON.c (parse_string): Ditto. * src/gpgme-json.c (main): Ditto. -- gcc 8 enables a couple of new warnings. Some of them are useless for us. In particular: util.h:42:26: warning: division 'sizeof (char *) / sizeof (char)' does not compute the number of array elements [-Wsizeof-pointer-div] #define DIM(v) (sizeof(v)/sizeof((v)[0])) ^ trustlist.c:101:22: note: in expansion of macro 'DIM' if (strlen (p) == DIM(item->keyid) - 1) Which is a real standard way to use DIM, here the right hand side is equivalent to sizeof but nevertheless it is correct. Yes sir, we know C. The format string warnings I have seen were assuming that the time structure returns valued out of scope - but if the system is that broken, the s_n_printf catches this. Signed-off-by: Werner Koch

json: Wipe memory in cJSON_Delete

2018-08-08T12:27:24Z

* src/cJSON.c (cJSON_Delete): Wipe memory on deletion.

json: Only use calloc instead of malloc

2018-08-08T12:25:28Z

* src/cJSON.c, src/gpgme-json.c (CALLOC_ONLY): New define to change xmalloc / xtrymalloc to use calloc. -- Some people consider malloc dangerous as it might allow an information leak.

json: Add checks when skipping byte

2018-08-08T11:30:01Z

* src/cJSON.c (parse_string, cJSON_Minify): Check for terminating NULL byte when skipping the byte after a an escaped quote.

json: Minor cleanups in cJSON.c

2018-07-16T12:42:30Z

* src/cJSON.c: Add comments on the origin of the code. (parse_string): Allocate an extra byte for safeness. (cJSON_AddItemToArray): Allo ARRAY to be NULL. Signed-off-by: Werner Koch

json: Fix buffer overflow in cJSON.c

2018-07-16T10:37:06Z

* src/cJSON.c (parse_string): Correctly detect bad hex. -- The call to parse_hex4 checks that only hex digits follow and in the error case returns 0. However, by the time of the combined check for an invalid value and the error PTR has already been set to the last hex character and thus if the end-of-string or a quote character was one of the bad hex digits the loop will miss the end of the string which does not match with the simple buffer length allocation test at the begin of the function. Signed-off-by: Werner Koch

json: Allow to compile with libgpg-error < 1.28

2018-06-05T07:40:17Z

* src/cJSON.c: Use gpgrt fucntion only if available. -- We have a hack in gpgme-json to allow building with older libgpg-error versions. That whole thing will not work but the instead the binary will print an error at runtime that it needs to be build with a newer libgcrypt. There was a little bug here for the Debian packages libgpg-error versions which failed to build cJSON. cJSON is only needed be the full gpgme-json but nevertheless the Makefile wants to build it. The fix is straightforward. GnuPG-bug-id: 3971 Signed-off-by: Werner Koch