apr_escape_json(): Don't truncate escaped \uXXXX characters.

apr_snprintf() takes the buffer size (including NUL). While at it add a test for control characters escaping. git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1916391 13f79535-47bb-0310-9956-ffa450edef68
apache · Mar 18, 2024 · c4512b1 · c4512b1
1 parent 4578be2
commit c4512b1
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/encoding/apr_escape.c b/encoding/apr_escape.c
@@ -1275,8 +1275,9 @@ APR_DECLARE(apr_status_t) apr_escape_json(char *escaped, const char *str,
                         break;
                     default:
                         if (c < 0x20) {
-                            size += apr_snprintf((char *)d, 6, "\\u%04x", c);
-                            d += 5; 
+                            apr_snprintf((char *)d, 7, "\\u%04x", c);
+                            size += 6;
+                            d += 6; 
                             found = 1;
                         }
                         else if (((c >> 7) == 0x00)) {
@@ -1374,7 +1375,7 @@ APR_DECLARE(apr_status_t) apr_escape_json(char *escaped, const char *str,
                         break;
                     default:
                         if (c < 0x20) {
-                            size += 5;
+                            size += 6; /* \uXXXX */
                             found = 1;
                         }
                         else if (((c >> 7) == 0x00)) {

diff --git a/test/testescape.c b/test/testescape.c
@@ -304,8 +304,8 @@ static void test_escape(abts_case *tc, void *data)
             (len == strlen(dest) + 1));
 
     /* all ascii */
-    src = " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
-    target = " !\\\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
+    src = "\x01\b\f\n\r\t\\ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
+    target = "\\u0001\\b\\f\\n\\r\\t\\\\ !\\\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
     dest = apr_pescape_json(pool, src, APR_ESCAPE_STRING, 0);
     ABTS_ASSERT(tc,
                 apr_psprintf(pool, "json escaped (%s) does not match expected output (%s)",