Out-of-Bounds Read in Tencent RapidJSON

Executive Summary

This vulnerability is an out-of-bounds read flaw in Tencent RapidJSON up to version 1.1.0. It occurs in the GenericStringStream<UTF8<char>>::Take() function during regex parsing. The issue is triggered by crafted inputs, such as a 22-byte sequence with invalid UTF-8 like a trailing \xf0 byte in a character class. The function lacks bounds checking, allowing it to read beyond the allocated buffer when src_ advances past the buffer's end. This can lead to denial of service or potential information disclosure if adjacent heap memory is accessed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses Tencent RapidJSON version 1.1.0 or earlier. Inspect applications using RapidJSON's regex engine, especially those with JSON Schema validation using the pattern keyword. Look for crashes or memory corruption when processing crafted inputs with invalid UTF-8 sequences like trailing \xf0 bytes.

Useful 0 Not Useful 0

Impact Analysis

The impact includes denial of service due to crashes or memory corruption. If adjacent heap memory is accessed, it may also lead to information disclosure, where sensitive data is exposed. Applications using RapidJSON's regex engine, such as JSON Schema validation with the pattern keyword, are particularly affected.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update RapidJSON to a patched version if available. If not, apply a temporary fix by adding bounds checks in the GenericStringStream<UTF8<char>>::Take() function or ensure Peek() != 0 checks before every Take() call in GenericRegex::Parse(). Disable regex parsing in JSON Schema validation if possible until patched.

Useful 0 Not Useful 0