ninharp/ninlight-w600
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: cJSON-Verschachtelung begrenzen

Browse Source 
C1: Ein POST an /api/v1/device/state mit tief verschachteltem JSON (z.B.
20 Ebenen "[[[[...") lässt cJSONs rekursiven Parser den 6-KB-Stack des
HTTP-Tasks überlaufen - CJSON_NESTING_LIMIT war mit 1000 viel zu hoch und
FreeRTOS' Stack-Overflow-Checking ist aus. Begrenzt auf 8 Ebenen, sowohl
für die Firmware (third_party/cJSON/cJSON.c) als auch für die
Host-Tests (nl_cjson), damit beide dasselbe Verhalten zeigen.

Test: test_post_validation deckt jetzt einen Body mit 20 verschachtelten
Arrays ab (400 "invalid json").
This commit is contained in:
Michael Sauer
2026-09-11 23:50:45 +02:00
parent de49647f9d
commit 89c764514a
3 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+4
View File
@@ -73,6 +73,10 @@ set(NL_FW_SOURCES
src/sys/nl_app_api.c src/sys/nl_app_api.c
third_party/cJSON/cJSON.c) third_party/cJSON/cJSON.c)
# C1: deeply nested JSON must not overflow the 6 KB HTTP task stack (parse_value recurses).
set_source_files_properties(third_party/cJSON/cJSON.c PROPERTIES
COMPILE_DEFINITIONS "CJSON_NESTING_LIMIT=8")
set(NL_FW ninlight_${NINLIGHT_DEVICE}) set(NL_FW ninlight_${NINLIGHT_DEVICE})
add_executable(${NL_FW} ${NL_SDK_BOOT_SOURCES} ${NL_FW_SOURCES} ${NL_SDK_OBJECTS}) add_executable(${NL_FW} ${NL_SDK_BOOT_SOURCES} ${NL_FW_SOURCES} ${NL_SDK_OBJECTS})
set_target_properties(${NL_FW} PROPERTIES SUFFIX ".elf") set_target_properties(${NL_FW} PROPERTIES SUFFIX ".elf")
test/CMakeLists.txt
+2
View File
@@ -15,6 +15,8 @@ enable_testing()
# cJSON is third-party code: build it without -Werror. # cJSON is third-party code: build it without -Werror.
add_library(nl_cjson STATIC ${CMAKE_CURRENT_SOURCE_DIR}/../third_party/cJSON/cJSON.c) add_library(nl_cjson STATIC ${CMAKE_CURRENT_SOURCE_DIR}/../third_party/cJSON/cJSON.c)
target_include_directories(nl_cjson PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/../third_party/cJSON) target_include_directories(nl_cjson PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/../third_party/cJSON)
# C1: match the firmware's nesting limit so host tests exercise the same behaviour.
target_compile_definitions(nl_cjson PUBLIC CJSON_NESTING_LIMIT=8)
set(NL_SRC ${CMAKE_CURRENT_SOURCE_DIR}/../src) set(NL_SRC ${CMAKE_CURRENT_SOURCE_DIR}/../src)
test/test_api.c
+1
View File
@@ -100,6 +100,7 @@ static void test_post_validation(void)
static const struct { const char *body; const char *err; } CASES[] = { static const struct { const char *body; const char *err; } CASES[] = {
{"not json", "invalid json"}, {"not json", "invalid json"},
{"[1,2]", "invalid json"}, {"[1,2]", "invalid json"},
{"{\"a\":[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]}", "invalid json"}, /* C1: 20 levels > CJSON_NESTING_LIMIT */
{"{\"on\":1}", "invalid on"}, {"{\"on\":1}", "invalid on"},
{"{\"brightness\":0}", "invalid brightness"}, {"{\"brightness\":0}", "invalid brightness"},
{"{\"brightness\":101}", "invalid brightness"}, {"{\"brightness\":101}", "invalid brightness"},