commit 7c1be8ddd11a0ae7936cd5afc2c58c11735f88f3
author Kasun Athukorala <kasunath@google.com> Tue Jul 15 05:44:04 2025 +0000
committer Kasun Athukorala <kasunath@google.com> Tue Jul 15 17:22:15 2025 +0000
tree 11fed9af0e9c761a35671b949c65e30bcf0624bf
parent 6fd03fbf98ffe6d7713cc9fa1fe9ef8c34514163

Check dictionary sizes to avoid any heap overflows

Tested:
Unit tested

Signed-off-by: Kasun Athukorala <kasunath@google.com>
Change-Id: I34972b7f4daf0e818461ef2a4842966a247fc20e

test/bej_decoder_test.cpp

diff --git a/test/bej_decoder_test.cpp b/test/bej_decoder_test.cpp
index cf76d2b..f881c3e 100644
--- a/test/bej_decoder_test.cpp
+++ b/test/bej_decoder_test.cpp
@@ -66,8 +66,11 @@
 
     BejDictionaries dictionaries = {
         .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
         .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
         .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
     };
 
     BejDecoderJson decoder;
@@ -108,8 +111,11 @@
 
     BejDictionaries dictionaries = {
         .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
         .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
         .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
     };
 
     // Each array element below consists of a set and two properties, resulting
@@ -167,8 +173,11 @@
 
     BejDictionaries dictionaries = {
         .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
         .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
         .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
     };
 
     auto root = std::make_unique<RedfishPropertyParent>();
@@ -228,8 +237,11 @@
 
     BejDictionaries dictionaries = {
         .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
         .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
         .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
     };
 
     auto root = std::make_unique<RedfishPropertyParent>();
@@ -258,8 +270,11 @@
 
     BejDictionaries dictionaries = {
         .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
         .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
         .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
     };
 
     auto root = std::make_unique<RedfishPropertyParent>();
@@ -282,4 +297,61 @@
                 bejErrorInvalidSize);
 }
 
+TEST(BejDecoderSecurityTest, InvalidSchemaDictionarySize)
+{
+    auto inputsOrErr = loadInputs(dummySimpleTestFiles);
+    ASSERT_TRUE(inputsOrErr);
+
+    BejDictionaries dictionaries = {
+        .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = 10,
+        .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
+        .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
+    };
+
+    BejDecoderJson decoder;
+    EXPECT_THAT(decoder.decode(dictionaries, inputsOrErr->encodedStream),
+                bejErrorInvalidSize);
+}
+
+TEST(BejDecoderSecurityTest, InvalidAnnotationDictionarySize)
+{
+    auto inputsOrErr = loadInputs(dummySimpleTestFiles);
+    ASSERT_TRUE(inputsOrErr);
+
+    BejDictionaries dictionaries = {
+        .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
+        .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = 10,
+        .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = inputsOrErr->errorDictionarySize,
+    };
+
+    BejDecoderJson decoder;
+    EXPECT_THAT(decoder.decode(dictionaries, inputsOrErr->encodedStream),
+                bejErrorInvalidSize);
+}
+
+TEST(BejDecoderSecurityTest, InvalidErrorDictionarySize)
+{
+    auto inputsOrErr = loadInputs(dummySimpleTestFiles);
+    ASSERT_TRUE(inputsOrErr);
+
+    BejDictionaries dictionaries = {
+        .schemaDictionary = inputsOrErr->schemaDictionary,
+        .schemaDictionarySize = inputsOrErr->schemaDictionarySize,
+        .annotationDictionary = inputsOrErr->annotationDictionary,
+        .annotationDictionarySize = inputsOrErr->annotationDictionarySize,
+        .errorDictionary = inputsOrErr->errorDictionary,
+        .errorDictionarySize = 10,
+    };
+
+    BejDecoderJson decoder;
+    EXPECT_THAT(decoder.decode(dictionaries, inputsOrErr->encodedStream),
+                bejErrorInvalidSize);
+}
+
 } // namespace libbej