fix: keep emoji escape tail bounded (#142)
Summary
- stop emoji escaping at the end of a truncated or invalid UTF-8 tail
- add an ASAN-backed regression test for the bounded-input case
- authenticate same-repository pull request coverage uploads with Codecov OIDC while preserving tokenless uploads for forks
Root cause
When fewer than four bytes remained,
DoEscapecopied one raw byte and usedcontinue. That skipped thenb == 0termination check, allowing the loop to read beyond the input and eventually underflow the remaining length.Scope
include/sonic/internal/arch/common/quote_common.htests/quote_test.cpp.github/workflows/test_coverage.ymlNo public API changes. The unrelated JSONPath, header self-containment, and broader CI changes from the earlier revision were removed.
Validation
- regression test on the old implementation reproduced an AddressSanitizer
heap-buffer-overflowASAN_OPTIONS=detect_leaks=0 ./build/tests/unittest '--gtest_filter=Quote.*' --gtest_brief=1— 3/3 passedASAN_OPTIONS=detect_leaks=0 ./build/tests/unittest --gtest_brief=1— 303/303 passedgit diff --check origin/master...HEADactionlint .github/workflows/test_coverage.yml- GitHub Actions
Test Coveragerun29555640052— passed, including the Codecov OIDC upload
版权所有:中国计算机学会技术支持:开源发展技术委员会
京ICP备13000930号-9
京公网安备 11010802047560号
Sonic-Cpp
A fast JSON serializing & deserializing library, accelerated by SIMD.
Requirement
Features
Benchmarks
use CMake
use bazel
Performance by sonic benchmark
Parsing Performance
Serializing performance
Performance by third-party benchmark
Below data is test by https://github.com/miloyip/nativejson-benchmark:
Parsing Performance
Serializing Performance
API Document
Make sure Doxygen 1.8.13 or higher version has been installed. Then following:
Design
Sonic-cpp parses JSON into a compact document tree. The document structure is as follows:
There are many optimizations in parsing as follows:
Sonic-cpp serializes a document to JSON. When serializing JSON strings, we should check the escaped characters first. So, we use SIMD instructions(AVX2/SSE) to find the escaped char for a long JSON string.
Sonic-cpp also supports ParseOnDemand if the user knows the target key at compile time. ParseOndemand also used SIMD and bit manipulation to skip the unwanted values fastly.
Usage
Include
Sonic-Cpp is a header-only library, you only need to include the directory of Sonic-Cpp header files, such as adding
-I/path/to/sonic/include/to your compiler.Parsing and Serializing
Checking parse result
Getting and Setting
The following Is*, Get* and Set* methods are supported:
More usage.
RoadMap
RawNumberfor JSON parsing.JSON Path.JSON Merge Patch.JSON Pointer.Contributing
Please read CONTRIBUTING.md for information on contributing to sonic-cpp.