mirror of
https://github.com/protocolbuffers/protobuf-go.git
synced 2025-01-01 11:58:21 +00:00
f01a588e58
In internal/encoding/json, report an error when encountering a }
when we are expecting an object field value. For example, the input
`{"":}` now correctly results in an error at the closing } token.
In encoding/protojson, check for an unexpected EOF token in
skipJSONValue. This is redundant with the check in internal/encoding/json,
but adds a bit more defense against any other similar bugs that
might exist.
Fixes CVE-2024-24786
Change-Id: I03d52512acb5091c8549e31ca74541d57e56c99d
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/569356
TryBot-Bypass: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Commit-Queue: Damien Neil <dneil@google.com>
|
||
|---|---|---|
| .. | ||
| benchmarks | ||
| cmd | ||
| conformance | ||
| descfmt | ||
| descopts | ||
| detrand | ||
| editiondefaults | ||
| encoding | ||
| errors | ||
| filedesc | ||
| filetype | ||
| flags | ||
| fuzz | ||
| fuzztest | ||
| genid | ||
| impl | ||
| msgfmt | ||
| order | ||
| pragma | ||
| protobuild | ||
| protolegacy | ||
| set | ||
| strs | ||
| testprotos | ||
| version | ||
| weakdeps | ||